Risk of self signed certificates with Android

Question

In the OWASP top ten list for mobile, it is mentioned that self-signed certificates should never be allowed.

I want to check with others why is this so ? If I have a server back end for my mobile app, and I sign a key-pair myself (assuming myself as a CA). If I use pinning, I will use my own CA's public key to check the certificate, and then use the server's public key (this part seems safe to me - assuming attacker doesn't know the private keys).

But if I don't use pinning, then is the risk there because now the default CA's in Android can't be used to verify the certificate, and I will have to use trust all certificates to make it work ?

In Summary: I am asking about the situation when self-signed certificates are used without pinning for an Android app.

Answer 1

It sounds like your use of a self-signed certificate is safe. But any variation in your usage pattern runs risks. For example, if you connect to your server via a web browser or other tool, you will not be able to automatically validate the certificate. You can still do that manually, but it won't be automatic and is somewhat error prone.

I suspect that the T10 was focused on the general case and didn't bother saying "Unless you pin the cert to your app and only access the server via the app or always manually validate the cert."

If you care, you can go get a free SSL cert from StartSSL.com and just bypass the problem altogether (though cert pinning will add security even with a signed cert).

Answer 2

You don't have to trust all certificates to make it work.

• HttpClient:
  With an HTTP-client, you can load your custom truststore(containing your private PKI CA-chain) and the Android default-truststore into an SSLSocketFactory. It works great.
  
• Webview:
  The default-trustore is already trusted, but you'll have to code the validation routine for your custom-trustore, if there’s not a match.
  
• Web browser(not part of the app):
  The default CAs are trusted. And you can try to install manually your private CAs through android security-settings, it but doesn't always work.