Uploading report fails with: javax.net.ssl.SSLHandshakeException: Pin verification failed

Inizia dalla configurazione dell’app di esempio TrustKit indicata nell’issue e segui il percorso di caricamento del report quando report-uri utilizza lo stesso dominio di un endpoint con pinning. Riproduci il problema su Android 7 o versioni successive, quindi verifica che i report vengano caricati correttamente senza applicare la configurazione di pinning che causa il problema.

Describe the bug
Uploading report would fail with "Pin verification failed" if report-uri has same domain as the domain for which the pinning failed. This is most likely case for an organization.

To Reproduce
In the TrustKit sample app, www.google.com is configured with invalid pins. So pinning would fail. If the report-uri is also set to www.google.com, it would fail to upload report with javax.net.ssl.SSLHandshakeException: Pin verification failed.
Tested this on Android version 10. This issue should be reproduced on Android version 7 and above.

Expected behavior
We should be successfully able to upload reports without applying the pinning.

TrustKit configuration
Copy and paste your XML Network Security Policy.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config>
        <domain includeSubdomains="true">www.datatheorem.com</domain>
        <!-- Valid pins -->
        <pin-set expiration="2018-01-01">
            <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
            <pin digest="SHA-256">YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=</pin>
        </pin-set>
        <trustkit-config enforcePinning="true" disableDefaultReportUri="true">
            <report-uri>https://overmind.datatheorem.com/trustkit/report</report-uri>
        </trustkit-config>
    </domain-config>
    <domain-config enforcePinning="true">
        <domain includeSubdomains="true">www.google.com</domain>
        <pin-set>
            <!-- Invalid pins -->
            <pin digest="SHA-256">AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=</pin>
            <pin digest="SHA-256">BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=</pin>
        </pin-set>
        <trustkit-config enforcePinning="true" disableDefaultReportUri="true">
            <report-uri>https://www.google.com</report-uri>
        </trustkit-config>
    </domain-config>
    <domain-config enforcePinning="false">
        <domain includeSubdomains="true">localhost</domain>
        <trustkit-config
          enforcePinning="false"
          disableDefaultReportUri="true" />
    </domain-config>
</network-security-config>

App details:
TrustKit Demo app
Tested this on Android version 10. This issue should be reproduced on Android version 7 and above.

Additional context
Note that, I tested failure with invalid pin approach. I suppose results would be similar for MITM attack as well?
Is it expected to apply pining for report upload as well? If so wouldn't it obviously fail?
May be I am missing something here. Please let me know.
Thanks.