Questions tagged [certificate-pinning]
92 questions
364
votes
6 answers
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate pinning?

Son of the Wai-Pan
- 3,765
- 3
- 10
- 5
30
votes
3 answers
What is the purpose of frequently rotating TLS certificates without changing underlying keys?
I read in the OWASP cheat sheet regarding certificate / public-key pinning that “Google rotates its certificates … about once a month … [but] the underlying public keys … remain static”.
Increasing the frequency of key rotation makes sense to me in…

Arran Schlosberg
- 904
- 1
- 7
- 14
24
votes
3 answers
Difference between Certificate pinning and public key pinning
I understand what pinning is. I had read about Certificate pinning and I appreciated it's use case. But today I learned pinning can be of two types -
pin the certificate or
pin the public key
Certificate and Public Key Pinning
I would like to…

Aniket Thakur
- 945
- 1
- 8
- 11
10
votes
2 answers
Does Renewing SSL certificate change its thumbprint / Fingerprint
I would like to know, if renewing a SSL certificate will change my thumbprint? The certificate has expired.
If it can be same then under what conditions can it remain same.
Many thanks in advance.

Godwin
- 201
- 1
- 2
- 4
10
votes
1 answer
What does EMET do for Windows 8.1?
I recall seeing, upon release of Windows 8 a while ago that a number of new mitigations and memory protections had been put in place but i'm unsure if these are the same protections offered by EMET. Based on the bypasses discussed it appears that…

NULLZ
- 11,426
- 17
- 77
- 111
10
votes
1 answer
Certificate Pinning Best Practice or Alternative
I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario: I have a native mobile app and I have pinned the certificate so that the app can validate against my server.
Problem: The problem comes in 1 year when…

errMSG
- 177
- 2
- 10
9
votes
3 answers
Can we prevent SSL Pinning Bypass by pinning key instead of certificate?
I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be easily bypassed using an SSL by-pass tool.
For iOS…

HAK
- 201
- 2
- 7
9
votes
2 answers
Risk of self signed certificates with Android
In the OWASP top ten list for mobile, it is mentioned that self-signed certificates should never be allowed.
I want to check with others why is this so ? If I have a server back end for my mobile app, and I sign a key-pair myself (assuming myself…

Jake
- 1,095
- 3
- 12
- 20
8
votes
4 answers
How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
I'd like to have my server APIs only accept requests from my own app, to prevent other "rogue" clients of my service.
As i understand it, the way to do this would be with a "client certificate" that the app sends, and that the web server is…

Daniel Magliola
- 413
- 1
- 4
- 7
7
votes
2 answers
HTTP Public Key Pinning vs Certificate Transparency, which is better and why?
We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well.
The security team's arguments for pinning are:
Pinning…

Aman
- 171
- 3
7
votes
3 answers
Certficate pinning: should I pin the leaf or intermediate?
I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp.
As our app clients do not update their app regulary I don't want to take the risk by using our server certification (Leaf…

NotCool
- 195
- 1
- 7
7
votes
1 answer
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like to use LE certs in our mobile apps as well.
The…

TrickyDupes
- 2,809
- 1
- 13
- 27
6
votes
2 answers
How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?
I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the clients side and this is how it works. However is…

Irene Ant
- 659
- 7
- 19
5
votes
1 answer
HPKP-based persistent denial-of-service attack on web sites
HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by any other certificate.
Can this be used to…

D.W.
- 98,420
- 30
- 267
- 572
5
votes
1 answer
What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?
I have a pki infrastructure for internal company use.
In this pki there are multiple registration authorities whose responsibility is to.
receive certificate issuance requests
verify the identity of the user/device/entity requesting the…

Giovanni Spiricchi
- 53
- 3