verify
Verifies an X.509 certificate against the configured pins for domain.
Parameters
A bare hostname or IP literal to validate (e.g., "api.example.com", "192.0.2.7") — not a URL. Inputs containing a scheme, path, port, or userinfo are rejected (fail-closed) in both modes; extract the host first (e.g. URI.host).
X.509 certificate object to verify
End-to-end deadline in milliseconds. Default 30s. Clamped to [MIN_OPERATION_TIMEOUT_MS, MAX_OPERATION_TIMEOUT_MS] (currently 10s–120s) to bound both pathologically short timeouts that race with TLS handshakes and unbounded blocking.
Throws
if setup has not been called (or has not completed successfully) on this instance
if a setup call is currently in flight
if an internal lock cannot be acquired
if certificate doesn't match any configured pins
if all configured pins have expired
if domain is not configured (strict mode only)
if the pinning configuration cannot be fetched and no cached configuration is available — fail-closed in both modes; see TrustPinMode ("Configuration availability")
if the supplied timeout elapses before completion
Verifies a PEM-encoded certificate against the configured pins for domain.
Parameters
A bare hostname or IP literal to validate (e.g., "api.example.com", "192.0.2.7") — not a URL. Inputs containing a scheme, path, port, or userinfo are rejected (fail-closed) in both modes; extract the host first (e.g. URI.host).
PEM-encoded certificate string
End-to-end deadline in milliseconds. Default 30s. Clamped to [MIN_OPERATION_TIMEOUT_MS, MAX_OPERATION_TIMEOUT_MS] (currently 10s–120s) to bound both pathologically short timeouts that race with TLS handshakes and unbounded blocking.
Throws
if setup has not been called on this instance
if a setup call is currently in flight
if an internal lock cannot be acquired
if the PEM string cannot be parsed
if certificate doesn't match any configured pins
if all configured pins have expired
if domain is not configured (strict mode only)
if the pinning configuration cannot be fetched and no cached configuration is available — fail-closed in both modes; see TrustPinMode ("Configuration availability")
if the supplied timeout elapses before completion
Verifies the leaf of a server-presented certificate chain against the configured pins for domain.
Empty chains, and chains that exceed the SDK's internal chain-length limit, are rejected before any pin comparison is performed.
Parameters
A bare hostname or IP literal to validate (e.g., "api.example.com", "192.0.2.7") — not a URL. Inputs containing a scheme, path, port, or userinfo are rejected (fail-closed) in both modes; extract the host first (e.g. URI.host).
Server-presented certificate chain, leaf first
End-to-end deadline in milliseconds. Default 30s. Clamped to [MIN_OPERATION_TIMEOUT_MS, MAX_OPERATION_TIMEOUT_MS] (currently 10s–120s) to bound both pathologically short timeouts that race with TLS handshakes and unbounded blocking.
Throws
if setup has not been called on this instance
if a setup call is currently in flight
if an internal lock cannot be acquired
if the chain is empty or rejected by the limit
if the leaf doesn't match any configured pins
if all configured pins have expired
if domain is not configured (strict mode only)
if the pinning configuration cannot be fetched and no cached configuration is available — fail-closed in both modes; see TrustPinMode ("Configuration availability")
if the supplied timeout elapses before completion