How to simulate environment for testing whether SSL pinning is working fine in an Android application?

Question

I am using this Cordova plugin to implement SSL pinning in an Android application.

I don't know how to simulate the environment for testing if it's working fine.

The infosec team in my firm is telling me that if the connection is proxied (no other attacking thing), then the application will be getting another certificate from the proxy server and the app should alert about this.

But the above plugin tells me that the connection is secure even on proxied connections.

Answer 1

The infosec team probably meant using an intercepting proxy such as ZAP or Burp. A normal proxy passes the SSL connection through, using the original certificate. With an intercepting proxy your browser sets up a connection to the proxy, which has a different certificate.

Answer 2

Cordova does not support SSL Pinning - https://cordova.apache.org/docs/en/latest/guide/appdev/security/#certificate-pinning. The plugin you are using may be providing you an approximate SSL pinning feature. However, from a security standpoint, I think an approximate or fake SSL pinning is as good as having no SSL Pinning. If you really need to have SSL pinning in your App consider developing your App natively.