What I still don't understand about certificate pinning is - why am I still able to access Google apps through a corporate MITM? I know that I have the root cert for my corporation installed on my PC, but shouldn't Google throw an error when its sites are signed by a cert (my corporation's cert) that does not match one of the pinned certs on Google's servers? Maybe I'm misunderstanding how pinning works.
2
-
What browser are you doing that with?– user49075May 3, 2015 at 21:58
-
Chrome. With my current understanding of pinning, I assumed that with corporate MITM (I work in security consulting and am testing out a MITM solution that does malware analysis), I would not be able to access Google Apps because the pinned certificates do not match the cert used for the MITM.– jay-charlesMay 3, 2015 at 22:00
Add a comment
|
1 Answer
With browsers that have certificate pinning, user-installed root CAs are normally exempted from pinning requirements; if the certificate received doesn't match the pinned certificate or key but is signed by a custom-added CA, the browser doesn't complain. This is done to support the exact scenario here, as well as the scenario where a user decides to MitM themselves (to, for instance, inspect all of their own network traffic). Source (the blogger in question, Adam Langley, works on the Chrome network stack and Google's HTTPS infrastructure).
