makeTlsPair

Creates a literally matched TLS pair: an SSLSocketFactory and the exact X509TrustManager instance its SSLContext was initialized with.

Prefer this over calling makeSSLSocketFactory and makeTrustManager separately when an API takes both (OkHttp's sslSocketFactory(factory, trustManager)): the separate calls each build their own pipeline — same verdicts, but two internal validation caches — whereas this pair shares one:

val tls = TrustPin.default.makeTlsPair()
val client = OkHttpClient.Builder()
.sslSocketFactory(tls.sslSocketFactory, tls.trustManager)
.build()

Return

A new TlsPair with TrustPin validation

Throws

if the platform's TLS stack cannot be configured for pinning (JCE/JSSE failure — environmental, not a TrustPin policy decision).

if the SDK refuses to operate because the runtime environment is not a supported production Android device.