We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.

We recently switched to Lets Encrypt (LE) for our general website certificates and would like to use LE certs in our mobile apps as well.

The issue is our current certificate pinning framework requires the app to be resubmitted with each new certificate, so if using LE this would be every 3 months (the max length of a LE cert). This is not practical.

I have researched alternatives and the most viable seems to be public key hashing. So query the server get the cert, extract the public key and compare to a hash we have store in the app binary.

This method means we would manually create the Certificate Signing Request (CSR) used for LE, as currently it just creates a new one with every certificate request, in order to retain the original key pairing.

My question: Is this public key hashing the best solution for a long term certificate pinning inside a mobile app?

  • 3
    Pinning the key will work. However one could also pin the CA (ie the LE CA cert) and trust the CA to not maliciously issue. – SEJPM Sep 21 '17 at 14:24
  • You can just use a self-signed certificate with long expiry date and use it for app connections – PyQL Jan 18 '18 at 7:10
  • @Trickycm did you end up pining the public key? – ahbou Feb 20 '18 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.