I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet this Android Application is using a CDN (For all requests/responses).

I was wondering whether the certificate to be pinned should be of my own server? or should it be the CDN's certificate?


Certificate pinning means that your application will only accepts specific server certificates within a TLS handshake. This means, that you need to pin to the certificates which are actually provided by the server inside your TLS handshake. If your application is communicating only with a CDN this would thus be the certificates served by the CDN. If these are certificates created or bought by the CDN itself or if these are your own certificates which you've provided to the CDN depends on your specific and unknown setup with the CDN.

Please not also that you better only pin to certificates over which you have full control. For example, if you pin to certificates which are created by the CDN and can be changed by the CDN without asking you then the application might suddenly break since the CDN decided to change their certificates.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.