Questions tagged [certificate-pinning]
The certificate-pinning tag has no usage guidance.
67
questions
0
votes
1answer
46 views
Higher risk of no certificate pinning on mobile apps vs web apps?
Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But i rarely see people mentioning it for web applications.
The ...
0
votes
0answers
41 views
Charles Proxy intercepting SSL Pinning enabled traffic
An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
4
votes
1answer
156 views
Certficate pinning: should I pin the leaf or intermediate?
I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp.
As our app clients do not update their app regulary I don't want to take the risk ...
4
votes
2answers
74 views
Is pinning global root CA almost same as not having any certificate pinning at all?
I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?
...
1
vote
1answer
35 views
A query about SSL pinning [duplicate]
So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network ...
1
vote
2answers
109 views
Mutual TLS and Cert Pinning solving the same problem?
To prevent MITM from my app I will use cert pinning.
To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources.
...
0
votes
1answer
67 views
Can certificate pinning be achieved strictly at the network layer?
With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
1
vote
0answers
60 views
Certificate pinning for device firmware signing
What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
3
votes
1answer
346 views
Certificate Pinning for WebSockets
I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.
I would like to know ...
0
votes
0answers
40 views
Certificate Pinning with SockJS
What is the SockJS way of pinning SSL Certificates in the client side when contacting wss:// to avoid CA trust?
FYI, when using modules like HTTPS or WS, we can listen to the socket event and then on ...
2
votes
1answer
245 views
Does SSL inspection break applications utilizing certificate pinning?
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
540 views
Why does pinning a CA root certificate not present a security risk?
AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
1
vote
1answer
194 views
Use subject key identifier for certificate pinning
As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server.
...
1
vote
1answer
317 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
1answer
426 views
More clarity on Certificate, public key, hash
I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.
I've used below command to see what this certificate ...
0
votes
0answers
174 views
Proxying an Android application with Burp Suite
I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
0
votes
1answer
166 views
Mutual SSL for clients of SaaS cloud service
My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL.
The clients would use a library provided by us to connect to ...
2
votes
2answers
1k views
Does a public key stay the same when a certificate is renewed? [duplicate]
So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.
The rationale for this lay in the fact that we were told that ...
3
votes
2answers
480 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
2
votes
4answers
1k views
How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?
I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful.
However, I noticed ...
1
vote
1answer
441 views
Robust SSL pinning on IoT device with Let’s Encrypt
I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt.
To ...
1
vote
0answers
277 views
IRC client with ability to verify server's self-signed cert fingerprint [closed]
I'm playing around with UnrealIRCd on CentOS. Just went through the config and compiling and got the ircd up and running.
When I go to connect to it via HexChat I can only get through by checking the ...
0
votes
2answers
640 views
Can lack of certificate pinning be considered a vulnerability?
The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
1
vote
0answers
91 views
How do I intercept packages in a Facebook application?
I can not listen to HTTPS traffic in the Facebook application through Fiddler and Burp. SSL-Pinning is disabled through SLL Kill Switch 2 (other applications such as Twitter, Snapchat with SSL-Pinning ...
0
votes
2answers
341 views
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?
Because with HPKP ...
3
votes
1answer
1k views
Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?
Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
1
vote
1answer
266 views
Certificate Pinning with CDN
I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet ...
4
votes
1answer
309 views
How are pinned keys stored in the browser? How about performance with large lists?
Public-key pinning is a proposal that allows sites to pin their keys in the browser to protect against Man In The Middle attacks that try to forge a site's key. See
Internet Engineering Task Force (...
5
votes
0answers
1k views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
0
votes
1answer
115 views
Check certificate expiry along with Public key pinning
Will public key pinning completely avoids the default server authentication process by client?
For example, by default server authentication process server checks for certificate expiry, By ...
1
vote
0answers
633 views
Bypassing Certificate/SSL Pinning using AppMon
I'm trying to reverse engineer an app that has Native layer certificate pinning, I can't go that deep in to patching so I've been looking in to other available options, one i came accross was appmon, ...
0
votes
2answers
63 views
Can I somehow require a specific certificate for a domain?
My use-case is the following:
I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I'm not actually authenticating the machine but ...
4
votes
2answers
558 views
Certificate Pinning vs E2E Encryption
I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it ...
0
votes
1answer
364 views
If a MiTM has server's cert, how can certificate pinning protect against this?
In a scenario where client -> server through SSL, the server replies with the set of cert(chain-of-trust) which also contains the certificate pinned inside the client.
Let's say the Root CA is ...
1
vote
0answers
629 views
Is it possible to go through proxy while PK Pinning is enabled?
My JavaFX client application and server has PK Pinning enabled. However, some clients ask us to add proxy support to the client app because the direct access in their office is closed and all the ...
1
vote
1answer
2k views
Android SSL trust killer mitigation?
I have implemented SSL pinning in Android application but I am able to bypass using SSL trust killer. I am looking for some solution to be able to detect or prevent such attacks. One solution is to ...
1
vote
1answer
677 views
Cert Pinning on mobile app - does it really require a public SSL cert on the server side?
To implement Cert Pinning on a native mobile app on (e.g. iOS), a new API end-point is being established (e.g. api.example.com). This URL will be setup with a self-signed SSL certificate.
This API ...
1
vote
1answer
2k views
SSL Pinning: Managing changes in the pinned certification on client side
Let's assume that we have a client application talking to a server via SSL.
Let's also assume that the client is using SSL certificate pinning, i.e. the client will refuse the server certificate ...
1
vote
2answers
3k views
How to simulate environment for testing whether SSL pinning is working fine in an Android application?
I am using this Cordova plugin to implement SSL pinning in an Android application.
I don't know how to simulate the environment for testing if it's working fine.
The infosec team in my firm is ...
1
vote
1answer
224 views
Is domain/subdomain check necessary when doing public key pinning?
I recently worked on an mobile app and established public key pinning for connections with my server. Connections from the client app may be made to various subdomains of the main server domain.
Is ...
0
votes
1answer
222 views
Regarding SSL Pinning implementation
I have doubt. For android application security which SSL pinning method is good?
Deploying HTTP Public key pinning
Deploying certificate validation using *.bks format along with hostname verifier.
...
1
vote
1answer
2k views
err_ssl_pinned_key_not_in_cert_chain
I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error.
Earlier, I've added HTTP response header Public Key Pins with 1 ...
1
vote
1answer
281 views
How do websites prevent certificate forgery?
I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack ...
2
votes
1answer
729 views
Can the server detect when a client has disabled certificate pinning?
Many mobile applications enforce certificate pinning in order to make a man-in-the-middle attack difficult to accomplish. However, with a jailbroken/rooted device, it's possible to disable the ...
0
votes
1answer
2k views
Does WhatsApp use certificate pinning?
Does WhatsApp use certificate pinning? I found a post by Preatorian Security from February 2014 that points the lack of certificate pinning as a major security problem, and mentions:
Update 02/21/...
6
votes
2answers
1k views
How could mobile developers prevent bypassing certificate pinning with tools such as SSL Kill Switch?
I used SSL Kill Switch on some iOS mobile applications to try to bypass certificate pinning and I was successful. I understand that SSL Kill Switch "kills" the certificate validation process on the ...
3
votes
0answers
81 views
Why more Android applications (compared to iOS) use certificate pinning? [closed]
I used mitmproxy to test the same 50 apps on iOS and Android and noticed that more than 50% of the Android applications compared to 23% of iOS, used certificate pinning.
Is there any explanation as ...
1
vote
0answers
782 views
Charles Proxy: Genymotion with certificate pinning
Is there anyway I can use charles proxy with an android app that is using certificate pinning? I read this thread: http://blog.attify.com/2015/08/24/intercepting-network-traffic-android/ and it says ...
5
votes
1answer
357 views
Intercept pinned SSL connection with private key
Can I intercept https traffic that uses certificate pinning using fiddler if I have the private key of the cert?
I am trying to intercept traffic between our mobile apps and API, and the mobile apps ...
2
votes
1answer
1k views
Is there any way or tool to check whether a particular iOS app is implementing SSL Pinning functionality?
I'm just learning the iOS security. This is completely a beginner question.
I'm trying to figure out whether there is any particular way to check if an iOS app is implementing SSL Pinning ...
