Downloading list of pinned certificates

Question

I'm thinking about implementing certificate pinning in a mobile app. The app will need to connect to several secure sites. Rather than having to update the app every time one of their certificates expire, would it make sense to:

• create a self-signed cert with an expiration date far in the future
• publish a list of valid certs for the app, on a server that uses that self-signed cert
• pin this self-signed cert in the app
• when the app launches, download that list, and start pinning the additional certs in it

Or is there any reason this would be a bad idea?

Answer 1

What you are describing is actually your own, reduced auto-update feature, limited to updating what amounts to a "trust store" for certificates.

The bad thing about it is that it works outside of the normal app update mechanism, without much possible user intervention, so the user will get the updates whether he wants them or not.

The good thing about it is that it works outside of the normal app update mechanism, without needing user intervention, so the user will get the updates even if he believed that he could live without them.

Google Chrome has been doing just that for some time, and even update the actual software code, not just the trust stores; and it seems to work well with them. As @mikeazo comments, if your "root private key" (the private key for your self-signed certificate) ever gets stolen, you are in deep trouble, so maybe you should use a signature strategy: instead of making your server be some HTTPS server (with the self-signed certificate for SSL), make it a plain HTTP server, but have the "list of valid certs" be a signed piece of data. That way, you can handle the signature process on a distinct machine, preferably an offline computer (if the private key never leaves a computer which is never linked to any network, then chances are that the private key will not be compromised remotely).