I have a mobile app deployed to millions of user in both Android and iOS.
My Security dpto rotates our certs once a year.
Our certs are issued by GlobalSign.

I would like to pin the certificate without having to worry about the rotation of those, so I would like to:

  1. Pin the Root public key
  2. Pin the leaf FQDN (CN)

The idea is: With the guarantee that the CN is what I expect it to be and the chain leads to my FQDN, I could be certain that im talking to my real backend without having to go through hoops and mass redeploy when the certificate rotates.

I know that im exposed to:

a) somehow Globalsign is hacked b) someone getting access to my account at GS and issuing another certificate for my FQDN...

but other than those, what other attacks I could suffer?

  • 1
    Next certificate may be chained to a different root. Commercial PKI providers tend to change their roots and issuing CAs much faster than their expiration (which is often around 15-25 years). And suppose you get unhappy with GlobalSign and decide to move elsewhere?
    – Crypt32
    Feb 2 at 15:32
  • thanks! addressing the topic of item 1, would it be possible to map ALL root certificates from a given CA? although they do get re-issued, I believe that they tend to do so way less frequently than once a year, fair? Also, I adopt another CA and I have a certificate pinned, I have to redeploy no matter what, no?
    – Leonardo
    Feb 3 at 19:38


You must log in to answer this question.

Browse other questions tagged .