Will public key pinning completely avoids the default server authentication process by client?

For example, by default server authentication process server checks for certificate expiry, By implementing public key pinning it means that only public key will verified, and the certificate expiry check that happens as part of default server authentication will not happen?


The usual public key pinning as done in browsers is done additionally to the other validations. But one could implement public key pinning in specific applications so that it relies only on the key or certificate. This might make for example sense when the application developer controls both client and server and the server uses a self-signed certificate for authentication.

| improve this answer | |
  • we are actullay implementing this for an iOS app. will it be the same case as with the browsers? – nari447 Sep 1 '17 at 16:58
  • @Nareshsadu: this depends on the actual implementation – Steffen Ullrich Sep 1 '17 at 17:07
  • Thank you @Steffen Ullrich, I will open another question with actual implementation details, so that the question would be more specific. – nari447 Sep 6 '17 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.