Questions tagged [certificate-pinning]
The certificate-pinning tag has no usage guidance.
75
questions
0
votes
1answer
61 views
Force public key collision to break certificate pinning
I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol.
I already tried to set up a simple MITM ...
1
vote
1answer
62 views
Forge certificate for man in the middle attack
I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server that would ...
2
votes
1answer
37 views
Does a certificate with extended validation provide better security than certificate pinning?
It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.
4
votes
2answers
284 views
Is there no way to bypass certificate pinning without patching apps?
Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
1
vote
2answers
99 views
HTTP Public Key Pinning vs Certificate Transparency, which is better and why?
We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well.
The ...
0
votes
1answer
53 views
Rotating TLS Certs used with Public key Pinning
I have an app which connects to an API. The API TLS certificate is about to expire and we are using Public key Pinning.
How do I rotate the certs without disabling access to our users?
When ...
0
votes
1answer
87 views
Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?
I have an iOS app with certificate pinning to two different servers.
I want to test this certificate pinning with a MITM attack, so I did:
Set proxy at my PC, in macos wifi settings -> advanced -> ...
-1
votes
2answers
388 views
Trying to extract SSL client certificate from android app
I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate.
...
1
vote
1answer
79 views
Higher risk of no certificate pinning on mobile apps vs web apps?
Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But i rarely see people mentioning it for web applications.
The ...
0
votes
0answers
286 views
Charles Proxy intercepting SSL Pinning enabled traffic
An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
4
votes
1answer
510 views
Certficate pinning: should I pin the leaf or intermediate?
I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp.
As our app clients do not update their app regulary I don't want to take the risk ...
4
votes
2answers
93 views
Is pinning global root CA almost same as not having any certificate pinning at all?
I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?
...
1
vote
1answer
41 views
A query about SSL pinning [duplicate]
So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network ...
2
votes
2answers
222 views
Mutual TLS and Cert Pinning solving the same problem?
To prevent MITM from my app I will use cert pinning.
To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources.
...
0
votes
1answer
71 views
Can certificate pinning be achieved strictly at the network layer?
With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
1
vote
0answers
74 views
Certificate pinning for device firmware signing
What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
3
votes
1answer
580 views
Certificate Pinning for WebSockets
I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.
I would like to know ...
2
votes
1answer
369 views
Does SSL inspection break applications utilizing certificate pinning?
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
0
votes
2answers
845 views
Why does pinning a CA root certificate not present a security risk?
AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
1
vote
1answer
254 views
Use subject key identifier for certificate pinning
As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server.
...
1
vote
1answer
354 views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
0
votes
1answer
691 views
More clarity on Certificate, public key, hash
I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.
I've used below command to see what this certificate ...
0
votes
0answers
186 views
Proxying an Android application with Burp Suite
I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
0
votes
1answer
195 views
Mutual SSL for clients of SaaS cloud service
My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL.
The clients would use a library provided by us to connect to ...
2
votes
2answers
2k views
Does a public key stay the same when a certificate is renewed? [duplicate]
So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.
The rationale for this lay in the fact that we were told that ...
3
votes
2answers
522 views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
2
votes
4answers
1k views
How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?
I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful.
However, I noticed ...
1
vote
1answer
489 views
Robust SSL pinning on IoT device with Let’s Encrypt
I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt.
To ...
1
vote
0answers
330 views
IRC client with ability to verify server's self-signed cert fingerprint [closed]
I'm playing around with UnrealIRCd on CentOS. Just went through the config and compiling and got the ircd up and running.
When I go to connect to it via HexChat I can only get through by checking the ...
0
votes
2answers
813 views
Can lack of certificate pinning be considered a vulnerability?
The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
1
vote
0answers
97 views
How do I intercept packages in a Facebook application?
I can not listen to HTTPS traffic in the Facebook application through Fiddler and Burp. SSL-Pinning is disabled through SLL Kill Switch 2 (other applications such as Twitter, Snapchat with SSL-Pinning ...
0
votes
2answers
429 views
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?
Because with HPKP ...
3
votes
1answer
1k views
Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?
Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
1
vote
1answer
297 views
Certificate Pinning with CDN
I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet ...
4
votes
1answer
326 views
How are pinned keys stored in the browser? How about performance with large lists?
Public-key pinning is a proposal that allows sites to pin their keys in the browser to protect against Man In The Middle attacks that try to forge a site's key. See
Internet Engineering Task Force (...
5
votes
0answers
2k views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
0
votes
1answer
121 views
Check certificate expiry along with Public key pinning
Will public key pinning completely avoids the default server authentication process by client?
For example, by default server authentication process server checks for certificate expiry, By ...
1
vote
0answers
652 views
Bypassing Certificate/SSL Pinning using AppMon
I'm trying to reverse engineer an app that has Native layer certificate pinning, I can't go that deep in to patching so I've been looking in to other available options, one i came accross was appmon, ...
0
votes
2answers
63 views
Can I somehow require a specific certificate for a domain?
My use-case is the following:
I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I'm not actually authenticating the machine but ...
4
votes
2answers
620 views
Certificate Pinning vs E2E Encryption
I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it ...
0
votes
1answer
379 views
If a MiTM has server's cert, how can certificate pinning protect against this?
In a scenario where client -> server through SSL, the server replies with the set of cert(chain-of-trust) which also contains the certificate pinned inside the client.
Let's say the Root CA is ...
1
vote
0answers
715 views
Is it possible to go through proxy while PK Pinning is enabled?
My JavaFX client application and server has PK Pinning enabled. However, some clients ask us to add proxy support to the client app because the direct access in their office is closed and all the ...
1
vote
1answer
2k views
Android SSL trust killer mitigation?
I have implemented SSL pinning in Android application but I am able to bypass using SSL trust killer. I am looking for some solution to be able to detect or prevent such attacks. One solution is to ...
2
votes
1answer
733 views
Cert Pinning on mobile app - does it really require a public SSL cert on the server side?
To implement Cert Pinning on a native mobile app on (e.g. iOS), a new API end-point is being established (e.g. api.example.com). This URL will be setup with a self-signed SSL certificate.
This API ...
1
vote
1answer
2k views
SSL Pinning: Managing changes in the pinned certification on client side
Let's assume that we have a client application talking to a server via SSL.
Let's also assume that the client is using SSL certificate pinning, i.e. the client will refuse the server certificate ...
1
vote
2answers
3k views
How to simulate environment for testing whether SSL pinning is working fine in an Android application?
I am using this Cordova plugin to implement SSL pinning in an Android application.
I don't know how to simulate the environment for testing if it's working fine.
The infosec team in my firm is ...
1
vote
1answer
243 views
Is domain/subdomain check necessary when doing public key pinning?
I recently worked on an mobile app and established public key pinning for connections with my server. Connections from the client app may be made to various subdomains of the main server domain.
Is ...
0
votes
1answer
242 views
Regarding SSL Pinning implementation
I have doubt. For android application security which SSL pinning method is good?
Deploying HTTP Public key pinning
Deploying certificate validation using *.bks format along with hostname verifier.
...
1
vote
1answer
2k views
err_ssl_pinned_key_not_in_cert_chain
I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error.
Earlier, I've added HTTP response header Public Key Pins with 1 ...
1
vote
1answer
292 views
How do websites prevent certificate forgery?
I have recently developed interest about Wireless hacking, and I have seen in many instances in videos and stuff that people are (or more correctly, were) able to perform some kind of MitM attack ...
