Questions tagged [certificate-pinning]
The certificate-pinning tag has no usage guidance.
100
questions
1
vote
2
answers
128
views
How can I enhance the security of SSL pinning in my mobile app to prevent certificate exposure?
For example, let's say my backend address is api.xyz.com, and I have a mobile application. This application sends requests to api.xyz.com. The application employs SSL pinning, where it pins the ...
0
votes
0
answers
80
views
How to get Certificate's Subject Public Key from CSR
I am currently using this code to have the public key pinning
OkHttpClientFactory okHttpClientFactory = () -> {
CertificatePinner certificatePinner = new CertificatePinner.Builder()
...
- 101
0
votes
1
answer
89
views
Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?
I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory.
Then built a client app that is an executable, then pinned the public key hash for ...
- 103
1
vote
1
answer
148
views
Benefits of certificate pinning to leaf with intermediate as a backup?
According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup.
Any security measure is only as good ...
- 111
0
votes
0
answers
139
views
SSL/x509 certificate/public key expiration [duplicate]
I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
- 1
2
votes
0
answers
151
views
Public Key Certificate Pinning alternatives
In the domain of mobile application, certificate pinning topic is still relevant. I am trying to get opinions on best alternatives, because certificate pinning needs the storage of public keys within ...
- 121
1
vote
1
answer
2k
views
Is SSL pinning bypass considered a vulnerability? If yes, what are the tightening/solution suggestions?
I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps.
Frankly, the applications I test are critical bank ...
- 15
1
vote
1
answer
300
views
How can authoritarian governments sniff TLS encrypted traffic on mass scale?
I tried sniffing TLS web traffic on my own network and I always run against the following complications:
I need to install an additional root cert on my devices
I need to root my phone to do ...
- 1,162
0
votes
2
answers
240
views
Could certificate pinning work if one checks the intermediate certificate when the leaf certificate already expired?
I have the following scenario:
When the leaf certificate expires, the intermediate certificate is checked and if the intermediate is not expired, the application will keep running and will not be ...
- 1
6
votes
1
answer
184
views
What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?
I have a pki infrastructure for internal company use.
In this pki there are multiple registration authorities whose responsibility is to.
receive certificate issuance requests
verify the identity of ...
0
votes
1
answer
573
views
Can I bypass SSL pinning If I found the certificate hardcoded in the application
I found an x509 certificate hardcoded in an application and after looking into the code I found that is used to validate certificates(SSL pinning). Can I bypass SSL pinning with the certificate that I ...
2
votes
0
answers
313
views
Request to produce Android APK without 'certificate pinning'
Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
- 131
1
vote
0
answers
174
views
Insufficient SSL certificate pinning in an native Android app
I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed:
Converted .crt file to .bks file
Added the .bks file to the asset folder in project structure
...
- 11
0
votes
1
answer
2k
views
Intercepting app with Burp shows no requests
I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop.
But no ...
9
votes
3
answers
8k
views
Can we prevent SSL Pinning Bypass by pinning key instead of certificate?
I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be ...
- 201
0
votes
1
answer
478
views
Should certificate pinning be implemented if the app can use many servers?
In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application.
The vendor sells software that it's customers ...
- 43
0
votes
1
answer
118
views
Public Key Pinning Attack? [duplicate]
I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
- 131
1
vote
1
answer
185
views
If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?
I have some questions about certificate pinning.
Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
- 11
1
vote
1
answer
729
views
Can't log in into Twitter for Android app after SSL Bypass
I don't know if this is the right forum for this kind of question.
I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
- 21
2
votes
1
answer
231
views
Is certificate pinning enough to protect client (native mobile app) - server communication?
My use case is the following: I want to create an app with React Native that I can deploy on both iOS and Android.
The app should consume an RSS feed (https call) from the server but there is no need ...
- 315
12
votes
1
answer
6k
views
Certificate Pinning Best Practice or Alternative
I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario: I have a native mobile app and I have pinned the certificate so that the app can validate ...
- 197
4
votes
3
answers
327
views
How can you bind a public key to a certificate if the public key depends on the choice of algorithms?
Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
- 47
0
votes
1
answer
147
views
How can I locate and purchase SSL certificates that contain a specific trust chain?
I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which ...
- 103
0
votes
0
answers
113
views
Using application encryption instead of relying on HTTPS
I use Google Firebase Services. I am thinking about using only https on mobile to send and receive a payload from my server. I will have RSA encryption with a public key on all clients. So when a ...
0
votes
1
answer
184
views
How to pin public root key when downloading an image with docker pull (Docker Content Trust)?
How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
- 998
1
vote
1
answer
271
views
Force public key collision to break certificate pinning
I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol.
I already tried to set up a simple MITM ...
- 23
1
vote
1
answer
468
views
Forge certificate for man in the middle attack
I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
- 23
2
votes
1
answer
167
views
Does a certificate with extended validation provide better security than certificate pinning?
It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.
4
votes
2
answers
12k
views
Is there no way to bypass certificate pinning without patching apps?
Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
- 143
7
votes
2
answers
2k
views
HTTP Public Key Pinning vs Certificate Transparency, which is better and why?
We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well.
The ...
- 171
2
votes
1
answer
740
views
Rotating TLS Certs used with Public key Pinning
I have an app which connects to an API. The API TLS certificate is about to expire and we are using Public key Pinning.
How do I rotate the certs without disabling access to our users?
When ...
- 651
0
votes
1
answer
1k
views
Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?
I have an iOS app with certificate pinning to two different servers.
I want to test this certificate pinning with a MITM attack, so I did:
Set proxy at my PC, in macos wifi settings -> advanced -> ...
- 103
-1
votes
2
answers
3k
views
Trying to extract SSL client certificate from android app
I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate.
...
- 135
0
votes
2
answers
751
views
Higher risk of no certificate pinning on mobile apps vs web apps?
Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But I rarely see people mentioning it for web applications.
The ...
- 121
1
vote
0
answers
2k
views
Charles Proxy intercepting SSL Pinning enabled traffic
An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
- 11
8
votes
3
answers
7k
views
Certficate pinning: should I pin the leaf or intermediate?
I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp.
As our app clients do not update their app regulary I don't want to take the risk ...
- 205
4
votes
2
answers
458
views
Is pinning global root CA almost same as not having any certificate pinning at all?
I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?
...
- 203
1
vote
1
answer
111
views
A query about SSL pinning [duplicate]
So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network ...
4
votes
2
answers
4k
views
Mutual TLS and Cert Pinning solving the same problem?
To prevent MITM from my app I will use cert pinning.
To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources.
...
- 1,264
0
votes
1
answer
138
views
Can certificate pinning be achieved strictly at the network layer?
With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
- 11
1
vote
0
answers
163
views
Certificate pinning for device firmware signing
What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
- 11
3
votes
1
answer
2k
views
Certificate Pinning for WebSockets
I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.
I would like to know ...
2
votes
1
answer
1k
views
Does SSL inspection break applications utilizing certificate pinning?
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
- 494
3
votes
2
answers
2k
views
Why does pinning a CA root certificate not present a security risk?
AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
- 494
2
votes
1
answer
905
views
Use subject key identifier for certificate pinning
As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server.
...
- 142
1
vote
1
answer
603
views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
- 113
0
votes
1
answer
2k
views
More clarity on Certificate, public key, hash
I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.
I've used below command to see what this certificate ...
- 103
0
votes
0
answers
449
views
Proxying an Android application with Burp Suite
I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
- 123
1
vote
1
answer
480
views
Mutual SSL for clients of SaaS cloud service
My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL.
The clients would use a library provided by us to connect to ...
- 11
3
votes
2
answers
10k
views
Does a public key stay the same when a certificate is renewed? [duplicate]
So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.
The rationale for this lay in the fact that we were told that ...
- 131