We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like to use LE certs in our mobile apps as well.
The issue is our current certificate pinning framework requires the app to be resubmitted with each new certificate, so if using LE this would be every 3 months (the max length of a LE cert). This is not practical.
I have researched alternatives and the most viable seems to be public key hashing. So query the server get the cert, extract the public key and compare to a hash we have store in the app binary.
This method means we would manually create the Certificate Signing Request (CSR) used for LE, as currently it just creates a new one with every certificate request, in order to retain the original key pairing.
My question: Is this public key hashing the best solution for a long term certificate pinning inside a mobile app?