0

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application.

The vendor sells software that it's customers deploy on premise (or on a private cloud). The end user download the vendor's generic mobile app from an app store and connect to their own backend.

Now I read in several sources (for example: here) that for mobile apps, certificate pinning should be implemented.

For an app that makes use of a preconfigured back end, I understand certificate pinning is relatively easy to implement and does enhance the encryption situation somewhat by mitigating the risk of fake certificates installed on the device, CA issues etc.

But for a vendor that has thousands of customers that could deploy their own instance of the software, I feel it is practically impossible to collect the certificates of their customers and to bundle in certificates or public keys (hashes). Certificate pinning is an enhancement, lacking this defensive measure is not necessarily a vulnerability.

Should the vendor in this context make the effort to implement certificate pinning with all certificate management terror that will bring? Are there any ways to pin that are feasible? Are there any alternatives to pinning that can be considered in this context?

1
  • If the app remembers the used server you could at the same time also save the root-ca certificate and pin it.
    – Robert
    Jul 23, 2021 at 1:44

1 Answer 1

0

there are many options to make this easier. You could distribute the organisations public key on login. The admin would register your organization key during the installation. And it would be pushed upon the login. The obvious alternative to pinning here is the use of a private CA that can be used in the context of the application. Also when you talk about the certificate being an enhancement, I see that quite differently in the case of a self-signed certificate, it seems like a good idea for those.

4
  • Interesting idea. So by pushing the key upon login you force all future communication to use that key - so if the first login was to the right server (and not a mitm) you're good for future logins. I don't understand the solution involving the private CA? That would require all users to install a certificate on their device? In response to the self signed certificate: I would expect that a proper external facing certificate is used on a web exposed server?
    – JazZeus
    Jul 22, 2021 at 7:17
  • The login could be protected by the certificate issued by the trusted CA. As for the private CA, you are right installing them on mobile devices is much more difficult nowadays so we can discard this part of my message. There are many ways of solving this problem. And I would guess that some type of key derivation is more elegant than pushing and pinning certificates around.
    – nethero
    Jul 22, 2021 at 19:23
  • How do you resolve a situation in which the backend gets a new certificate? I understand that it is best to renew the certificate, so that the same (pinned) public key is used, but I suppose something could happen which means a new certificate is to be used. In a traditional SSL pinning situation you can ship the new key in an update of the app, but in this scenario that is not possible. How would you resolve this situation? Give the user an option somehow to clear the pinned certificates? Or is there a more clever way to do this?
    – JazZeus
    Jul 26, 2021 at 6:45
  • The certificate can be pushed while the old one is still valid. Usually this kind of scenarios have some kind of mothership server that can take care of this.
    – nethero
    Jul 26, 2021 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .