Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [certificate-pinning]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
117 views

Can a VPN company perform a MiTM attack if SSL Pinning is in place?

Recently, I read news about Facebook acquired the Onavo VPN company to monitor Snapchat users' traffic. It seems they executed a Man-in-the-Middle attack by replacing the certificate. But could they ...
Robert Zunr's user avatar
0 votes
0 answers
58 views

Will this certificate Pinning plan work as expected?

I have a mobile app deployed to millions of user in both Android and iOS. My Security dpto rotates our certs once a year. Our certs are issued by GlobalSign. I would like to pin the certificate ...
Leonardo's user avatar
  • 119
0 votes
0 answers
176 views

Router level SSL Inspection

Is there any way I could inspect the traffic from an untrusted device connected to my network? I would like to get a router that has ssl inspection capabilities, where I could check the https packets ...
Paul's user avatar
  • 1
1 vote
2 answers
253 views

How can I enhance the security of SSL pinning in my mobile app to prevent certificate exposure?

For example, let's say my backend address is api.xyz.com, and I have a mobile application. This application sends requests to api.xyz.com. The application employs SSL pinning, where it pins the ...
actuallynoneed's user avatar
0 votes
0 answers
484 views

How to get Certificate's Subject Public Key from CSR

I am currently using this code to have the public key pinning OkHttpClientFactory okHttpClientFactory = () -> { CertificatePinner certificatePinner = new CertificatePinner.Builder() ...
Archie.bpgc's user avatar
0 votes
1 answer
286 views

Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?

I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory. Then built a client app that is an executable, then pinned the public key hash for ...
Subham Burnwal's user avatar
2 votes
1 answer
255 views

Benefits of certificate pinning to leaf with intermediate as a backup?

According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup. Any security measure is only as good ...
jon's user avatar
  • 121
0 votes
0 answers
238 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
Jeff's user avatar
  • 1
2 votes
0 answers
243 views

Public Key Certificate Pinning alternatives

In the domain of mobile application, certificate pinning topic is still relevant. I am trying to get opinions on best alternatives, because certificate pinning needs the storage of public keys within ...
Mr767267's user avatar
  • 121
2 votes
1 answer
2k views

Is SSL pinning bypass considered a vulnerability? If yes, what are the tightening/solution suggestions?

I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps. Frankly, the applications I test are critical bank ...
Exnovan's user avatar
  • 35
1 vote
1 answer
461 views

How can authoritarian governments sniff TLS encrypted traffic on mass scale?

I tried sniffing TLS web traffic on my own network and I always run against the following complications: I need to install an additional root cert on my devices I need to root my phone to do ...
user3280964's user avatar
  • 1,152
0 votes
2 answers
316 views

Could certificate pinning work if one checks the intermediate certificate when the leaf certificate already expired?

I have the following scenario: When the leaf certificate expires, the intermediate certificate is checked and if the intermediate is not expired, the application will keep running and will not be ...
osas's user avatar
  • 1
6 votes
1 answer
228 views

What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?

I have a pki infrastructure for internal company use. In this pki there are multiple registration authorities whose responsibility is to. receive certificate issuance requests verify the identity of ...
Giovanni Spiricchi's user avatar
0 votes
1 answer
718 views

Can I bypass SSL pinning If I found the certificate hardcoded in the application

I found an x509 certificate hardcoded in an application and after looking into the code I found that is used to validate certificates(SSL pinning). Can I bypass SSL pinning with the certificate that I ...
Joao Marono's user avatar
2 votes
0 answers
413 views

Request to produce Android APK without 'certificate pinning'

Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
bluearth's user avatar
  • 131
1 vote
0 answers
219 views

Insufficient SSL certificate pinning in an native Android app

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
Sangamesh T's user avatar
0 votes
1 answer
2k views

Intercepting app with Burp shows no requests

I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop. But no ...
Opera of the Phantom's user avatar
9 votes
3 answers
9k views

Can we prevent SSL Pinning Bypass by pinning key instead of certificate?

I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be ...
HAK's user avatar
  • 201
0 votes
1 answer
618 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
JazZeus's user avatar
  • 53
0 votes
1 answer
151 views

Public Key Pinning Attack? [duplicate]

I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
I'm Root James's user avatar
1 vote
2 answers
257 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
fabrom's user avatar
  • 11
1 vote
1 answer
884 views

Can't log in into Twitter for Android app after SSL Bypass

I don't know if this is the right forum for this kind of question. I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
bvr's user avatar
  • 21
2 votes
1 answer
272 views

Is certificate pinning enough to protect client (native mobile app) - server communication?

My use case is the following: I want to create an app with React Native that I can deploy on both iOS and Android. The app should consume an RSS feed (https call) from the server but there is no need ...
dierre's user avatar
  • 315
12 votes
1 answer
7k views

Certificate Pinning Best Practice or Alternative

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...
errMSG's user avatar
  • 197
4 votes
3 answers
385 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
Guy4444's user avatar
  • 47
0 votes
1 answer
173 views

How can I locate and purchase SSL certificates that contain a specific trust chain?

I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which ...
Aaron Wojnowski's user avatar
0 votes
0 answers
139 views

Using application encryption instead of relying on HTTPS

I use Google Firebase Services. I am thinking about using only https on mobile to send and receive a payload from my server. I will have RSA encryption with a public key on all clients. So when a ...
darren zou's user avatar
0 votes
1 answer
263 views

How to pin public root key when downloading an image with docker pull (Docker Content Trust)?

How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
Michael Altfield's user avatar
1 vote
1 answer
302 views

Force public key collision to break certificate pinning

I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol. I already tried to set up a simple MITM ...
me123's user avatar
  • 23
1 vote
1 answer
561 views

Forge certificate for man in the middle attack

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
me123's user avatar
  • 23
2 votes
1 answer
196 views

Does a certificate with extended validation provide better security than certificate pinning?

It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.
Melvin Briggs's user avatar
5 votes
2 answers
13k views

Is there no way to bypass certificate pinning without patching apps?

Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
Wis's user avatar
  • 153
7 votes
2 answers
3k views

HTTP Public Key Pinning vs Certificate Transparency, which is better and why?

We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well. The ...
Aman's user avatar
  • 171
2 votes
1 answer
922 views

Rotating TLS Certs used with Public key Pinning

I have an app which connects to an API. The API TLS certificate is about to expire and we are using Public key Pinning. How do I rotate the certs without disabling access to our users? When ...
Architect 's user avatar
0 votes
1 answer
1k views

Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?

I have an iOS app with certificate pinning to two different servers. I want to test this certificate pinning with a MITM attack, so I did: Set proxy at my PC, in macos wifi settings -> advanced -> ...
desudesudesu's user avatar
-1 votes
2 answers
4k views

Trying to extract SSL client certificate from android app

I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate. ...
Ali Padida's user avatar
2 votes
2 answers
979 views

Higher risk of no certificate pinning on mobile apps vs web apps?

Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But I rarely see people mentioning it for web applications. The ...
tturbox's user avatar
  • 141
1 vote
0 answers
2k views

Charles Proxy intercepting SSL Pinning enabled traffic

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
Wolfy's user avatar
  • 11
8 votes
3 answers
8k views

Certficate pinning: should I pin the leaf or intermediate?

I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp. As our app clients do not update their app regulary I don't want to take the risk ...
TooCool's user avatar
  • 205
4 votes
2 answers
528 views

Is pinning global root CA almost same as not having any certificate pinning at all?

I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all? ...
bi0s.kidd0's user avatar
1 vote
1 answer
136 views

A query about SSL pinning [duplicate]

So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network ...
Manish Kumar Sharma's user avatar
4 votes
2 answers
4k views

Mutual TLS and Cert Pinning solving the same problem?

To prevent MITM from my app I will use cert pinning. To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources. ...
Filipon's user avatar
  • 1,294
0 votes
1 answer
162 views

Can certificate pinning be achieved strictly at the network layer?

With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
account123's user avatar
1 vote
0 answers
187 views

Certificate pinning for device firmware signing

What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
RaSchi's user avatar
  • 11
3 votes
1 answer
2k views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
Thilina Ashen Gamage's user avatar
2 votes
1 answer
2k views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
Prime's user avatar
  • 514
3 votes
2 answers
2k views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
Prime's user avatar
  • 514
2 votes
1 answer
969 views

Use subject key identifier for certificate pinning

As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server. ...
John Kravicz's user avatar
1 vote
1 answer
638 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
scugn1zz0's user avatar
  • 113
0 votes
1 answer
2k views

More clarity on Certificate, public key, hash

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below. I've used below command to see what this certificate ...
Ramcharan Reddy's user avatar