6

When a mobile app is sending HTTPS requests, it verifies the server certificate against some kind of certificate store. My question is, would that certificate store be provided by the phone's OS, or would it be packed with the app?

I know I can do certificate pinning, but first I want to know what's the default.

If there's any difference between Android and iOS, I'd want to know that.

Improve this question
0

1 Answer 1

Reset to default
3

The short answer is that it depends on the application's implementation. Certificate pinning is not a default, it is rather a custom implementation. Default is to rely on system trust store - on iOS as well as Android.

In general the security best practice is to use SSL pinning. Pinning could be implemented in two ways - Including the entire certificate store to the client package or by including the signature for a certificate to the client package. You shall be able to verify this by reversing the client package.

Similar to the way most desktop applications work, mobile applications also by default rely on the trust store provided by the operating systems. On Android OS's before Android 7.0, the user could install a custom certificate to the system trust store from an SD Card. This resulted in trivial MITM attacks and the capability has since been removed from later versions. Applications no longer trusts user installed certificates on android devices.

Improve this answer
5
  • To my knowledge, using a custom certificate store (on Android) is very uncommon. Not even the secure messenger Threema (on Android at least) does that, it uses the “Entrust Root Certification Authority - G2” certificate as per the support staff. It seem s to use pinning, though: os3.nl/_media/2013-2014/courses/ssn/projects/threema_report.pdf
    – Marcel
    Commented Jan 6, 2020 at 9:13
  • ^ It is rare but I have seen such applications in the past.
    – hax
    Commented Jan 6, 2020 at 9:18
  • 1
    @Marcel I am curious to know why you mentioned 'not even secure messenger Threema'. Is that app a benchmark for something?
    – hax
    Commented Jan 6, 2020 at 14:09
  • Not per se, but since they are globally recognised and claim to be "secure" ( and I would think that implementing it's own certificate store associates with security) this may be a worthwile example.
    – Marcel
    Commented Jan 7, 2020 at 6:49
  • @Marcel I don't think that adding a whole certificate or a truststore improve security in anyway. That was not what I wanted to convey, if at all It implied so. I was just referring to a bunch of applications I have come across in the past while doing mobile appsec.
    – hax
    Commented Jan 7, 2020 at 10:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .