Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning purpose.

What does this mean? How can I produce this? Where can I find out more about this?

As additional information, the app has been under production use for about five year. The app is Cordova app using Crosswalk that targets Android SDK 19 to 28.

  • Did you check if your application even uses certificate pinning?
    – user163495
    Commented Mar 9, 2022 at 6:18
  • My problem being that I am not familiar with the concept thus don't even know where to start looking. I googled around and found this OWASP page but it's still pretty dense for me.
    – bluearth
    Commented Mar 9, 2022 at 13:31
  • 1
    Read the Cordova documentation: "Cordova does not support true certificate pinning...". On Android you can try to use network security config to perform cert pinning, not sure if this works for cordova apps.
    – Robert
    Commented Mar 9, 2022 at 15:00
  • @Robert From the link you provided, I went through all resources files of the app. I can't find any network_security_config.xml files nor other configuration files that contain network security config elements such as <pin> or <pinset>. Is it safe to say that my app does not employ certificate pinning?
    – bluearth
    Commented Mar 10, 2022 at 8:04
  • You won't find it unless you have created one and have linked it in AndroidManifest.xml. Check the various tutorials on that topic.
    – Robert
    Commented Mar 10, 2022 at 8:05


You must log in to answer this question.

Browse other questions tagged .