I just started dipping my feet into security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now, but most of them deal with it taking the browser and server example. With regards to mobile, I didn't find much data.

I assume the questions are dumb for veterans, but here they are anyway:

  • If I get an SSL certificate for the Web Server my WebServices are hosted on, do I need to change the code of my mobile app? Apart from using HTTPS instead of HTTP while calling the service.

  • If the theory is the same as in a browser, how is the data being encrypted? I mean who is doing it? Browsers do it while accessing a secure website. But in case of my App, will the phone be doing it?

  • Both Android and iOS provide some sort of support for SSL traffic. In Android just visiting a website via the HTTPS link will work just fine if the website uses a well known Certificate Authority. Android will handle the key exchange and encryption for you. If you have your own certificate that isn't trusted, then you'll have to install it on the device via your App. – RoraΖ Oct 20 '14 at 11:24
  • @raz So no code level changes are needed then? That would mean that the only change I need to do is to change the webservice URL from http to https. Is that it? – doodla Oct 21 '14 at 5:02
  • It should be, as long as your certificate is signed by a well known Certificate Authority. – RoraΖ Oct 21 '14 at 11:19

Generally speaking, no, you will not have to do anything more that change the protocol (http to https) in order to encrypt your application's traffic. Most web-client libraries support both protocols transparently.

Some additional things to consider as a mobile application developer:

  1. Do not disable certificate validation routines, or catch and discard errors. This is unfortunately common in mobile applications and completely destroys the security benefits of using SSL/TLS in the first place by allowing a MitM to capture and decrypt traffic without any warning to the user.

  2. Consider certificate pinning. This requires some extra work on your part, but enhances security by ensuring that not only is the certificate used to protect the users' traffic is a valid certificate, but it is your certificate, the specific certificate you expect them to use. This is an extra security measure that may or may not be warranted, depended on what you're protecting, but is worth taking a look at.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.