I recently worked on an mobile app and established public key pinning for connections with my server. Connections from the client app may be made to various subdomains of the main server domain.

Is checking for proper domain or subdomain associated with the public certificate in the server authentication process increasing security? I mean - if I'm anyway checking for the public key, is it necessary to check also for domain and subdomain? If so, why? What can I do to perform domain/subdomain check while not knowing all possible subdomains at time of deploying app to the production?


There are various kinds of public key pinning and the answer depends on what you actually do. If you pin to the key of the servers certificate and only expect a single specific certificate for the server then additionally checking the URL you access against the subject of the certificate is probably not necessary, since there should only be this single certificate with this key (or maybe multiple similar certificates when renewing).

If instead you reuse the same public key for many certificates (bad idea) or if you pin to the key of the issuing CA instead of the leaf certificate then you should also verify that the subject of the certificate matches the name in the URL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.