status

Sources/Networking/TLSPinning.swift

@@ -44,10 +44,21 @@ final class PinnedTrustDelegate: NSObject, URLSessionDelegate {
             completionHandler(.performDefaultHandling, nil)
             return
         }
-        if TLSPinning.matchesPinnedCert(trust) {
-            completionHandler(.useCredential, URLCredential(trust: trust))
+        // Apply the fixed self-signed pin only to the pinned LAN deployment
+        // host. Other explicitly configured HTTPS hosts use normal system
+        // trust evaluation (Finding 12). This allows public deployments and
+        // other LAN hosts with valid certificates while never weakening trust
+        // for the default self-signed host.
+        let host = challenge.protectionSpace.host
+        if host == TLSPinning.host {
+            if TLSPinning.matchesPinnedCert(trust) {
+                completionHandler(.useCredential, URLCredential(trust: trust))
+            } else {
+                completionHandler(.cancelAuthenticationChallenge, nil)
+            }
         } else {
-            completionHandler(.cancelAuthenticationChallenge, nil)
+            // Non-pinned host: let the system evaluate the certificate chain.
+            completionHandler(.performDefaultHandling, nil)
         }
     }
 }