1

For example, let's say my backend address is api.xyz.com, and I have a mobile application. This application sends requests to api.xyz.com. The application employs SSL pinning, where it pins the certificate it easily obtained from api.xyz.com. Is this really secure? If someone notices that my application is making requests to api.xyz.com, they could obtain the site's certificate just like I did, either through a web browser or via different websites.

What's the magical thing that prevents a malicious actor from obtaining the certificate from api.xyz.com?

Thanks(@dave_thompson_085, @ThoriumBR) for valuable answers. I needed to add questions based on yours.

My expectation was as follows:

Let's consider that our server (api.xyz.com) has an API endpoint at api.xyz.com/DoSomethingImportant, and our mobile application sends requests to this endpoint. The mobile app pins the certificate for security, ensuring that no one can intercept the data exchanged in the requests and responses. As a result, only I can consume the resources behind the DoSomethingImportant function on our server.

At this point, what is the role of the 'private key'? Do I need to use it within the mobile application?

Improve this question
4
  • 1
    Nothing prevents an attacker from obtaining the real-server's cert but they can't use it to impersonate the server because they don't have the privatekey. This is fundamental to SSL/TLS (indeed to all public-key cryptography) and has been answered dozens if not hundreds of times; please look at some of them. What pinning prevents is the attacker getting their own cert for your domain name, for example by hacking your DNS or using a defective or corrupt CA, and using that cert rather than yours.
    – dave_thompson_085
    Commented Oct 13, 2023 at 1:21
  • I have just extended my answer based on latest information you provided !
    – actuallynoneed
    Commented Oct 13, 2023 at 9:43
  • Related: security.stackexchange.com/questions/105376/…
    – mti2935
    Commented Oct 13, 2023 at 9:57
  • WRT 'As a result, only I can consume the resources behind the DoSomethingImportant function on our server' - how does the fact that your mobile app pins the certificate of your server API prevent others from using your server's API? It sounds like you need a way for your app to authenticate with your API, but your app pinning the server's certificate is not a solution for this. You may want to considering using Oauth2, or client certificates, as possible ways for your mobile app (client) to authenticate with your server.
    – mti2935
    Commented Oct 13, 2023 at 16:42

2 Answers 2

Reset to default
2

A certificate is meant to be public, so if your security depends on the certificate to api.xyz.com being secret, you are doing it wrong.

Certificate pinning is a way to make difficult to an attacker to intercept the communication using an intercepting proxy. It does not stop an attacker, because the attacker can edit the application binary and change the pinned certificate.

Your application can implement certificate pinning, checksums, code obfuscation and other protections, but they will never stop a dedicated attacker. When they have control over the hardware and the OS, there's no client-side protection that can stop them, but only delay them.

So is this secure? I think so, as your security cannot depend on the certificate being secret. Someone acquiring your certificate will not reduce your overall security.

Improve this answer
1

Certificates work with asymmetric encryption. That uses a key pair, consisting of a public key and a corresponding private key. Something encrypted with the private key can be decrypted with the public key, and vice versa.

The certificate contains the public key and the domain name. Anyone can download that certificate from api.xyz.com, it is not secret. When setting up a connection, api.xyz.com encrypts something with the private key. The application decrypts that with the public key from the certificate, and that shows that api.xyz.com is indeed the owner of the private key belonging to that certificate.

The certificate is thus backed by a private key, and this cannot be simply downloaded.

What I described so far is just normal TLS. Certificate pinning further restricts which certificates are accepted by the application.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .