Don't pay to clean certificates if we aren't pinning.

square · Feb 9, 2016 · 456a745 · 456a745
1 parent c2e5cc4
commit 456a745
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/okhttp/src/main/java/okhttp3/CertificatePinner.java b/okhttp/src/main/java/okhttp3/CertificatePinner.java
@@ -147,14 +147,14 @@ private CertificatePinner(Builder builder) {
    */
   public void check(String hostname, List<Certificate> peerCertificates)
       throws SSLPeerUnverifiedException {
-    if (trustRootIndex != null) {
-      peerCertificates = new CertificateChainCleaner(trustRootIndex).clean(peerCertificates);
-    }
-
     Set<ByteString> pins = findMatchingPins(hostname);
 
     if (pins == null) return;
 
+    if (trustRootIndex != null) {
+      peerCertificates = new CertificateChainCleaner(trustRootIndex).clean(peerCertificates);
+    }
+
     for (int i = 0, size = peerCertificates.size(); i < size; i++) {
       X509Certificate x509Certificate = (X509Certificate) peerCertificates.get(i);
       if (pins.contains(sha1(x509Certificate))) return; // Success!