Questions tagged [certificate-pinning]
The certificate-pinning tag has no usage guidance.
61
questions
0
votes
2answers
56 views
Can certificate pinning be achieved strictly at the network layer?
With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
1
vote
0answers
45 views
Certificate pinning for device firmware signing
What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
2
votes
1answer
180 views
Certificate Pinning for WebSockets
I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.
I would like to know ...
0
votes
0answers
21 views
Certificate Pinning with SockJS
What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust?
FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
2
votes
1answer
119 views
Does SSL inspection break applications utilizing certificate pinning?
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
237 views
Why does pinning a CA root certificate not present a security risk?
AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
1
vote
1answer
139 views
Use subject key identifier for certificate pinning
As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server.
...
1
vote
1answer
247 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
1answer
229 views
More clarity on Certificate, public key, hash
I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.
I've used below command to see what this certificate ...
0
votes
0answers
138 views
Proxying an Android application with Burp Suite
I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
0
votes
1answer
127 views
Mutual SSL for clients of SaaS cloud service
My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL.
The clients would use a library provided by us to connect to ...
2
votes
2answers
374 views
Does a public key stay the same when a certificate is renewed? [duplicate]
So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.
The rationale for this lay in the fact that we were told that ...
3
votes
2answers
421 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
2
votes
4answers
968 views
How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?
I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful.
However, I noticed ...
1
vote
1answer
361 views
Robust SSL pinning on IoT device with Let’s Encrypt
I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt.
To ...
1
vote
0answers
223 views
IRC client with ability to verify server's self-signed cert fingerprint [closed]
I'm playing around with UnrealIRCd on CentOS. Just went through the config and compiling and got the ircd up and running.
When I go to connect to it via HexChat I can only get through by checking the ...
0
votes
2answers
511 views
Can lack of certificate pinning be considered a vulnerability?
The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
1
vote
0answers
79 views
How do I intercept packages in a Facebook application?
I can not listen to HTTPS traffic in the Facebook application through Fiddler and Burp. SSL-Pinning is disabled through SLL Kill Switch 2 (other applications such as Twitter, Snapchat with SSL-Pinning ...
0
votes
2answers
286 views
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?
Because with HPKP ...
3
votes
1answer
963 views
Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?
Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
1
vote
1answer
236 views
Certificate Pinning with CDN
I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet ...
4
votes
1answer
285 views
How are pinned keys stored in the browser? How about performance with large lists?
Public-key pinning is a proposal that allows sites to pin their keys in the browser to protect against Man In The Middle attacks that try to forge a site's key. See
Internet Engineering Task Force (...
5
votes
0answers
1k views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
0
votes
1answer
107 views
Check certificate expiry along with Public key pinning
Will public key pinning completely avoids the default server authentication process by client?
For example, by default server authentication process server checks for certificate expiry, By ...
1
vote
0answers
603 views
Bypassing Certificate/SSL Pinning using AppMon
I'm trying to reverse engineer an app that has Native layer certificate pinning, I can't go that deep in to patching so I've been looking in to other available options, one i came accross was appmon, ...
0
votes
2answers
62 views
Can I somehow require a specific certificate for a domain?
My use-case is the following:
I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I'm not actually authenticating the machine but ...
4
votes
2answers
512 views
Certificate Pinning vs E2E Encryption
I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it ...
0
votes
1answer
339 views
If a MiTM has server's cert, how can certificate pinning protect against this?
In a scenario where client -> server through SSL, the server replies with the set of cert(chain-of-trust) which also contains the certificate pinned inside the client.
Let's say the Root CA is ...
1
vote
0answers
583 views
Is it possible to go through proxy while PK Pinning is enabled?
My JavaFX client application and server has PK Pinning enabled. However, some clients ask us to add proxy support to the client app because the direct access in their office is closed and all the ...
1
vote
1answer
2k views
Android SSL trust killer mitigation?
I have implemented SSL pinning in Android application but I am able to bypass using SSL trust killer. I am looking for some solution to be able to detect or prevent such attacks. One solution is to ...
1
vote
1answer
624 views
Cert Pinning on mobile app - does it really require a public SSL cert on the server side?
To implement Cert Pinning on a native mobile app on (e.g. iOS), a new API end-point is being established (e.g. api.example.com). This URL will be setup with a self-signed SSL certificate.
This API ...
1
vote
1answer
1k views
SSL Pinning: Managing changes in the pinned certification on client side
Let's assume that we have a client application talking to a server via SSL.
Let's also assume that the client is using SSL certificate pinning, i.e. the client will refuse the server certificate ...
1
vote
2answers
2k views
How to simulate environment for testing whether SSL pinning is working fine in an Android application?
I am using this Cordova plugin to implement SSL pinning in an Android application.
I don't know how to simulate the environment for testing if it's working fine.
The infosec team in my firm is ...
1
vote
1answer
206 views
Is domain/subdomain check necessary when doing public key pinning?
I recently worked on an mobile app and established public key pinning for connections with my server. Connections from the client app may be made to various subdomains of the main server domain.
Is ...
0
votes
1answer
204 views
Regarding SSL Pinning implementation
I have doubt. For android application security which SSL pinning method is good?
Deploying HTTP Public key pinning
Deploying certificate validation using *.bks format along with hostname verifier.
...
1
vote
1answer
2k views
err_ssl_pinned_key_not_in_cert_chain
I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error.
Earlier, I've added HTTP response header Public Key Pins with 1 ...
1
vote
1answer
265 views
How do websites prevent certificate forgery?
I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack ...
2
votes
1answer
684 views
Can the server detect when a client has disabled certificate pinning?
Many mobile applications enforce certificate pinning in order to make a man-in-the-middle attack difficult to accomplish. However, with a jailbroken/rooted device, it's possible to disable the ...
0
votes
1answer
2k views
Does WhatsApp use certificate pinning?
Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions:
Update 02/21/...
6
votes
2answers
1k views
How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?
I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
2
votes
0answers
79 views
Why more Android applications (compared to iOS) use certificate pinning? [closed]
I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning.
Is there any explanation as ...
1
vote
0answers
761 views
Charles Proxy: Genymotion with certificate pinning
Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
4
votes
1answer
345 views
Intercept pinned SSL connection with private key
Can I intercept https traffic that uses certificate pinning using fiddler if I have the private key of the cert?
I am trying to intercept traffic between our mobile apps and API, and the mobile apps ...
2
votes
1answer
1k views
Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?
I'm just learning the iOS security. This is completely a beginner question.
I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
7
votes
2answers
927 views
Risk of self signed certificates with Android
In the OWASP top ten list for mobile, it is mentioned that self-signed certificates should never be allowed.
I want to check with others why is this so ? If I have a server back end for my mobile ...
4
votes
1answer
393 views
Public Key Certificate Pinning and MITM attack
So I was looking at an example of how to implement public key pinning for when your app connects to your web service and you want to have your app ensure it's really talking to your server.
http://...
0
votes
1answer
1k views
Certificate pinning in android apps
I have found a whitepaper on bypassing ssl pinning. If this is true, how can we securely implement certificate pinning in android apps? Is there any other workarounds possible other than certificate ...
1
vote
1answer
1k views
Does certificate pinning protect against Fiddler?
We have a mobile app that connects to our server via RESTful HTTPS web services. We also have an attacker who correctly emulates our app in communicating with our server. We therefore assume that our ...
4
votes
1answer
551 views
HPKP-based persistent denial-of-service attack on web sites
HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
0
votes
2answers
123 views
Is there a way to attack STARTTLS + certificate pinning probed from multiple places?
I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
