README

Certificates and SSL pinning

Add or update certificates

1. Download the new certificate file (.cer, .crt, or .pem) from the issuer.
2. Place it in java/resources/cert (production) or java/resources/cert-test (demo/test).
3. Update java/Makefile with a new keytool -alias ... -import -file ./resources/cert/<file> line under cert (or cert-test for test certs) and keep the expiry comment current.
4. Run make -C java cert (or make -C java cert-test for demo/test) to rebuild the truststore (java/resources/truststore.jks or java/resources/truststore-test.jks).

Update SSL public key pins

1. If the Mobile ID server certificate changes or you add a new mid.sk.ee cert, regenerate pins with make -C java ssl-pins for production or make -C java ssl-pinning-test for demo.
2. Copy the generated sha256//... string into withSslPinnedPublicKeys(...) in class/AuthenticateRest.php for the matching environment.