Questions tagged [certificate-pinning]
The certificate-pinning tag has no usage guidance.
1
vote
1answer
73 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
1answer
47 views
More clarity on Certificate, public key, hash
I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.
I've used below command to see what this certificate ...
0
votes
0answers
65 views
Proxying an Android application with Burp Suite
I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
0
votes
1answer
78 views
Mutual SSL for clients of SaaS cloud service
My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL.
The clients would use a library provided by us to connect to ...
1
vote
2answers
130 views
Does a public key stay the same when a certificate is renewed? [duplicate]
So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.
The rationale for this lay in the fact that we were told that ...
3
votes
2answers
368 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
2
votes
4answers
557 views
How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?
I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful.
However, I noticed ...
1
vote
1answer
258 views
Robust SSL pinning on IoT device with Let’s Encrypt
I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt.
To ...
1
vote
0answers
87 views
IRC client with ability to verify server's self-signed cert fingerprint [closed]
I'm playing around with UnrealIRCd on CentOS. Just went through the config and compiling and got the ircd up and running.
When I go to connect to it via HexChat I can only get through by checking the ...
0
votes
2answers
387 views
Can lack of certificate pinning be considered a vulnerability?
The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
1
vote
0answers
67 views
How do I intercept packages in a Facebook application?
I can not listen to HTTPS traffic in the Facebook application through Fiddler and Burp. SSL-Pinning is disabled through SLL Kill Switch 2 (other applications such as Twitter, Snapchat with SSL-Pinning ...
0
votes
2answers
218 views
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?
Because with HPKP ...
3
votes
1answer
731 views
Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?
Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
1
vote
1answer
191 views
Certificate Pinning with CDN
I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet ...
4
votes
1answer
236 views
How are pinned keys stored in the browser? How about performance with large lists?
Public-key pinning is a proposal that allows sites to pin their keys in the browser to protect against Man In The Middle attacks that try to forge a site's key. See
Internet Engineering Task Force (...
3
votes
0answers
1k views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
0
votes
1answer
87 views
Check certificate expiry along with Public key pinning
Will public key pinning completely avoids the default server authentication process by client?
For example, by default server authentication process server checks for certificate expiry, By ...
1
vote
0answers
567 views
Bypassing Certificate/SSL Pinning using AppMon
I'm trying to reverse engineer an app that has Native layer certificate pinning, I can't go that deep in to patching so I've been looking in to other available options, one i came accross was appmon, ...
0
votes
2answers
60 views
Can I somehow require a specific certificate for a domain?
My use-case is the following:
I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I'm not actually authenticating the machine but ...
4
votes
2answers
422 views
Certificate Pinning vs E2E Encryption
I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it ...
0
votes
1answer
305 views
If a MiTM has server's cert, how can certificate pinning protect against this?
In a scenario where client -> server through SSL, the server replies with the set of cert(chain-of-trust) which also contains the certificate pinned inside the client.
Let's say the Root CA is ...
1
vote
0answers
533 views
Is it possible to go through proxy while PK Pinning is enabled?
My JavaFX client application and server has PK Pinning enabled. However, some clients ask us to add proxy support to the client app because the direct access in their office is closed and all the ...
1
vote
1answer
2k views
Android SSL trust killer mitigation?
I have implemented SSL pinning in Android application but I am able to bypass using SSL trust killer. I am looking for some solution to be able to detect or prevent such attacks. One solution is to ...
1
vote
1answer
556 views
Cert Pinning on mobile app - does it really require a public SSL cert on the server side?
To implement Cert Pinning on a native mobile app on (e.g. iOS), a new API end-point is being established (e.g. api.example.com). This URL will be setup with a self-signed SSL certificate.
This API ...
0
votes
1answer
1k views
SSL Pinning: Managing changes in the pinned certification on client side
Let's assume that we have a client application talking to a server via SSL.
Let's also assume that the client is using SSL certificate pinning, i.e. the client will refuse the server certificate ...
1
vote
2answers
2k views
How to simulate environment for testing whether SSL pinning is working fine in an Android application?
I am using this Cordova plugin to implement SSL pinning in an Android application.
I don't know how to simulate the environment for testing if it's working fine.
The infosec team in my firm is ...
1
vote
1answer
178 views
Is domain/subdomain check necessary when doing public key pinning?
I recently worked on an mobile app and established public key pinning for connections with my server. Connections from the client app may be made to various subdomains of the main server domain.
Is ...
0
votes
1answer
170 views
Regarding SSL Pinning implementation
I have doubt. For android application security which SSL pinning method is good?
Deploying HTTP Public key pinning
Deploying certificate validation using *.bks format along with hostname verifier.
...
1
vote
1answer
2k views
err_ssl_pinned_key_not_in_cert_chain
I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error.
Earlier, I've added HTTP response header Public Key Pins with 1 ...
1
vote
1answer
237 views
How do websites prevent certificate forgery?
I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack ...
2
votes
1answer
633 views
Can the server detect when a client has disabled certificate pinning?
Many mobile applications enforce certificate pinning in order to make a man-in-the-middle attack difficult to accomplish. However, with a jailbroken/rooted device, it's possible to disable the ...
0
votes
1answer
1k views
Does WhatsApp use certificate pinning?
Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions:
Update 02/21/...
6
votes
2answers
1k views
How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?
I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
2
votes
0answers
77 views
Why more Android applications (compared to iOS) use certificate pinning? [closed]
I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning.
Is there any explanation as ...
1
vote
0answers
708 views
Charles Proxy: Genymotion with certificate pinning
Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
4
votes
1answer
303 views
Intercept pinned SSL connection with private key
Can I intercept https traffic that uses certificate pinning using fiddler if I have the private key of the cert?
I am trying to intercept traffic between our mobile apps and API, and the mobile apps ...
2
votes
1answer
969 views
Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?
I'm just learning the iOS security. This is completely a beginner question.
I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
7
votes
2answers
886 views
Risk of self signed certificates with Android
In the OWASP top ten list for mobile, it is mentioned that self-signed certificates should never be allowed.
I want to check with others why is this so ? If I have a server back end for my mobile ...
4
votes
1answer
367 views
Public Key Certificate Pinning and MITM attack
So I was looking at an example of how to implement public key pinning for when your app connects to your web service and you want to have your app ensure it's really talking to your server.
http://...
0
votes
1answer
1k views
Certificate pinning in android apps
I have found a whitepaper on bypassing ssl pinning. If this is true, how can we securely implement certificate pinning in android apps? Is there any other workarounds possible other than certificate ...
1
vote
1answer
1k views
Does certificate pinning protect against Fiddler?
We have a mobile app that connects to our server via RESTful HTTPS web services. We also have an attacker who correctly emulates our app in communicating with our server. We therefore assume that our ...
4
votes
1answer
520 views
HPKP-based persistent denial-of-service attack on web sites
HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
0
votes
2answers
119 views
Is there a way to attack STARTTLS + certificate pinning probed from multiple places?
I just had this discussion on IRC and I have to admit I did not understand why other users were not convinced this would be enough... Let's say I would like to protect e-mails sent out from my ...
3
votes
1answer
304 views
Certificate Pinning and Corporate MITM
What I still don't understand about certificate pinning is - why am I still able to access Google apps through a corporate MITM? I know that I have the root cert for my corporation installed on my PC, ...
1
vote
2answers
2k views
Understanding Certificate Pinning [duplicate]
I am attempting to implement certificate pinning across a suite of mobile apps.
I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
2
votes
2answers
652 views
Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?
I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur,
RemoteCertificateChainErrors
...
26
votes
3answers
7k views
What is the purpose of frequently rotating TLS certificates without changing underlying keys?
I read in the OWASP cheat sheet regarding certificate / public-key pinning that “Google rotates its certificates … about once a month … [but] the underlying public keys … ...
13
votes
3answers
9k views
Difference between Certificate pinning and public key pinning
I understand what pinning is. I had read about Certificate pinning and I appreciated it's use case. But today I learned pinning can be of two types -
pin the certificate or
pin the public key
...
3
votes
2answers
269 views
Certificate pinning and the key distribution problem
I (think I) understand the concept of certificate pinning. However, I'm wondering if, in the worst-case scenario: is certificate pinning any more secure than the hierarchical trust model it is built ...
4
votes
4answers
2k views
How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
I'd like to have my server APIs only accept requests from my own app, to prevent other "rogue" clients of my service.
As i understand it, the way to do this would be with a "client certificate" that ...
