0

Will public key pinning completely avoids the default server authentication process by client?

For example, by default server authentication process server checks for certificate expiry, By implementing public key pinning it means that only public key will verified, and the certificate expiry check that happens as part of default server authentication will not happen?

1 Answer 1

0

The usual public key pinning as done in browsers is done additionally to the other validations. But one could implement public key pinning in specific applications so that it relies only on the key or certificate. This might make for example sense when the application developer controls both client and server and the server uses a self-signed certificate for authentication.

3
  • we are actullay implementing this for an iOS app. will it be the same case as with the browsers?
    – nari447
    Commented Sep 1, 2017 at 16:58
  • @Nareshsadu: this depends on the actual implementation Commented Sep 1, 2017 at 17:07
  • Thank you @Steffen Ullrich, I will open another question with actual implementation details, so that the question would be more specific.
    – nari447
    Commented Sep 6, 2017 at 10:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .