3

When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or would it be packed with the app?

I know I can do certificate pinning, but first I want to know what's the default.

If there's any difference between Android and iOS, I'd want to know that.

1

The short answer is that it depends on the application's implementation. Certificate pinning is not a default, it is rather a custom implementation. Default is to rely on system trust store - on iOS as well as Android.

In general the security best practice is to use SSL pinning. Pinning could be implemented in two ways - Including the entire certificate store to the client package or by including the signature for a certificate to the client package. You shall be able to verify this by reversing the client package.

Similar to the way most desktop applications work, mobile applications also by default rely on the trust store provided by the operating systems. On Android OS's before Android 7.0, the user could install a custom certificate to the system trust store from an SD Card. This resulted in trivial MITM attacks and the capability has since been removed from later versions. Applications no longer trusts user installed certificates on android devices.

| improve this answer | |
  • To my knowledge, using a custom certificate store (on Android) is very uncommon. Not even the secure messenger Threema (on Android at least) does that, it uses the “Entrust Root Certification Authority - G2” certificate as per the support staff. It seem s to use pinning, though: os3.nl/_media/2013-2014/courses/ssn/projects/threema_report.pdf – Marcel Jan 6 at 9:13
  • ^ It is rare but I have seen such applications in the past. – hax Jan 6 at 9:18
  • 1
    @Marcel I am curious to know why you mentioned 'not even secure messenger Threema'. Is that app a benchmark for something? – hax Jan 6 at 14:09
  • Not per se, but since they are globally recognised and claim to be "secure" ( and I would think that implementing it's own certificate store associates with security) this may be a worthwile example. – Marcel Jan 7 at 6:49
  • @Marcel I don't think that adding a whole certificate or a truststore improve security in anyway. That was not what I wanted to convey, if at all It implied so. I was just referring to a bunch of applications I have come across in the past while doing mobile appsec. – hax Jan 7 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.