This function is where we need to verify Server by extracting SSL certificate of server/api and validating against pinned ssl certificate.

SSLPinning.swift

func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust else {return}
        guard let serverTrustInfo = challenge.protectionSpace.serverTrust,
            let certificate = serverSSLCertificate(serverTrustInfo) else {return}
        
        // Either of the below methods "Public key pinning" or "Certificate pinning" can be done
//        guard let publicKeySha256 = sha256(certificate) else {return}
//        if pinnedPublicKeyHash == sha256(serverSSlPublicKey) {
//            completionHandler(.useCredential, URLCredential.init(trust: serverTrustInfo))
//        }else{
//            completionHandler(.cancelAuthenticationChallenge, nil)
//        }
        
        if pinnedCertificateHash == sha256(certificate) {
            completionHandler(.useCredential, URLCredential.init(trust: serverTrustInfo))
        }else{
            completionHandler(.cancelAuthenticationChallenge, nil)
        }
    }