I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory. Then built a client app that is an executable, then pinned the public key hash for all requests from this app to the server. All communications will be encrypted, and the server will only accept requests from this particular app, and not from browsers.
Now I find something like these studies which severely critic the capability and safety of HPKP: https://scotthelme.co.uk/im-giving-up-on-hpkp/ https://www.smashingmagazine.com/2016/10/be-afraid-of-public-key-pinning/?ref=scotthelme.co.uk
The Mozilla:// site (and elsewhere) also describes Certificate Pinning as an obsolete method..
Based on this I have three questions.
Firstly, I dont understand that while Pinning itself might be obsolete but is it still part of a good ensemble, especially in my case? I looked around for this and did not find anything convincing on this topic and any alternatives (except TACK ?), and am looking for guidance.
Secondly, for the problem of Key distribution, which I have guessed would be better if not done over the network, but only included with every update of the app. How about it?
And thirdly, for scaling up, when I would require more servers for load balancing client requests, how should that determine whether or not Pinning is worth it?
I have also got some clarity from the following but not much: Certificate pinning and the key distribution problem HPKP-based persistent denial-of-service attack on web sites