Questions tagged [certificate-pinning]
The certificate-pinning tag has no usage guidance.
89
questions
1
vote
0
answers
34
views
Request to produce Android APK without 'certificate pinning'
Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
- 111
1
vote
0
answers
43
views
Insufficient SSL certificate pinning in an native Android app
I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed:
Converted .crt file to .bks file
Added the .bks file to the asset folder in project structure
...
- 11
0
votes
1
answer
387
views
Intercepting app with Burp shows no requests
I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop.
But no ...
9
votes
3
answers
4k
views
Can we prevent SSL Pinning Bypass by pinning key instead of certificate?
I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be ...
- 201
0
votes
1
answer
165
views
Should certificate pinning be implemented if the app can use many servers?
In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application.
The vendor sells software that it's customers ...
- 33
0
votes
1
answer
81
views
Public Key Pinning Attack? [duplicate]
I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
- 131
0
votes
1
answer
109
views
If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?
I have some questions about certificate pinning.
Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
- 1
1
vote
1
answer
305
views
Can't log in into Twitter for Android app after SSL Bypass
I don't know if this is the right forum for this kind of question.
I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
- 21
1
vote
1
answer
111
views
Is certificate pinning enough to protect client (native mobile app) - server communication?
My use case is the following: I want to create an app with React Native that I can deploy on both iOS and Android.
The app should consume an RSS feed (https call) from the server but there is no need ...
- 295
9
votes
1
answer
2k
views
Certificate Pinning Best Practice or Alternative
I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario: I have a native mobile app and I have pinned the certificate so that the app can validate ...
- 165
4
votes
3
answers
241
views
How can you bind a public key to a certificate if the public key depends on the choice of algorithms?
Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
- 47
0
votes
1
answer
124
views
How can I locate and purchase SSL certificates that contain a specific trust chain?
I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which ...
- 103
0
votes
0
answers
104
views
Using application encryption instead of relying on HTTPS
I use Google Firebase Services. I am thinking about using only https on mobile to send and receive a payload from my server. I will have RSA encryption with a public key on all clients. So when a ...
0
votes
1
answer
92
views
How to pin public root key when downloading an image with docker pull (Docker Content Trust)?
How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
- 806
0
votes
1
answer
204
views
Force public key collision to break certificate pinning
I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol.
I already tried to set up a simple MITM ...
- 13
1
vote
2
answers
243
views
Forge certificate for man in the middle attack
I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
- 13
2
votes
1
answer
103
views
Does a certificate with extended validation provide better security than certificate pinning?
It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.
5
votes
2
answers
8k
views
Is there no way to bypass certificate pinning without patching apps?
Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
- 153
6
votes
2
answers
2k
views
HTTP Public Key Pinning vs Certificate Transparency, which is better and why?
We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well.
The ...
- 161
1
vote
1
answer
350
views
Rotating TLS Certs used with Public key Pinning
I have an app which connects to an API. The API TLS certificate is about to expire and we are using Public key Pinning.
How do I rotate the certs without disabling access to our users?
When ...
- 631
0
votes
1
answer
628
views
Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?
I have an iOS app with certificate pinning to two different servers.
I want to test this certificate pinning with a MITM attack, so I did:
Set proxy at my PC, in macos wifi settings -> advanced -> ...
- 103
-1
votes
2
answers
2k
views
Trying to extract SSL client certificate from android app
I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate.
...
- 125
1
vote
1
answer
364
views
Higher risk of no certificate pinning on mobile apps vs web apps?
Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But i rarely see people mentioning it for web applications.
The ...
- 111
1
vote
0
answers
1k
views
Charles Proxy intercepting SSL Pinning enabled traffic
An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
- 11
6
votes
3
answers
4k
views
Certficate pinning: should I pin the leaf or intermediate?
I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp.
As our app clients do not update their app regulary I don't want to take the risk ...
- 185
4
votes
2
answers
268
views
Is pinning global root CA almost same as not having any certificate pinning at all?
I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?
...
- 193
1
vote
1
answer
95
views
A query about SSL pinning [duplicate]
So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network ...
2
votes
2
answers
2k
views
Mutual TLS and Cert Pinning solving the same problem?
To prevent MITM from my app I will use cert pinning.
To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources.
...
- 1,182
0
votes
1
answer
122
views
Can certificate pinning be achieved strictly at the network layer?
With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
- 11
1
vote
0
answers
137
views
Certificate pinning for device firmware signing
What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
- 11
3
votes
1
answer
1k
views
Certificate Pinning for WebSockets
I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.
I would like to know ...
2
votes
1
answer
884
views
Does SSL inspection break applications utilizing certificate pinning?
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
- 412
2
votes
2
answers
2k
views
Why does pinning a CA root certificate not present a security risk?
AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
- 412
2
votes
1
answer
579
views
Use subject key identifier for certificate pinning
As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server.
...
- 142
1
vote
1
answer
501
views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
- 13
0
votes
1
answer
1k
views
More clarity on Certificate, public key, hash
I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below.
I've used below command to see what this certificate ...
- 103
0
votes
0
answers
313
views
Proxying an Android application with Burp Suite
I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
- 123
1
vote
1
answer
362
views
Mutual SSL for clients of SaaS cloud service
My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL.
The clients would use a library provided by us to connect to ...
- 11
3
votes
2
answers
6k
views
Does a public key stay the same when a certificate is renewed? [duplicate]
So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.
The rationale for this lay in the fact that we were told that ...
- 131
3
votes
2
answers
643
views
Configuration for Windows account mapped to IIS certificate authorization
I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs.
On the Windows machine, I ...
- 83
2
votes
4
answers
2k
views
How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?
I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful.
However, I noticed ...
user123540
1
vote
1
answer
743
views
Robust SSL pinning on IoT device with Let’s Encrypt
I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt.
To ...
- 247
1
vote
0
answers
576
views
IRC client with ability to verify server's self-signed cert fingerprint [closed]
I'm playing around with UnrealIRCd on CentOS. Just went through the config and compiling and got the ircd up and running.
When I go to connect to it via HexChat I can only get through by checking the ...
- 41
0
votes
2
answers
1k
views
Can lack of certificate pinning be considered a vulnerability?
The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
- 378
1
vote
0
answers
146
views
How do I intercept packages in a Facebook application?
I can not listen to HTTPS traffic in the Facebook application through Fiddler and Burp. SSL-Pinning is disabled through SLL Kill Switch 2 (other applications such as Twitter, Snapchat with SSL-Pinning ...
1
vote
2
answers
752
views
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?
Because with HPKP ...
- 6,200
3
votes
1
answer
1k
views
Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?
Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
1
vote
1
answer
418
views
Certificate Pinning with CDN
I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet ...
- 13
4
votes
1
answer
443
views
How are pinned keys stored in the browser? How about performance with large lists?
Public-key pinning is a proposal that allows sites to pin their keys in the browser to protect against Man In The Middle attacks that try to forge a site's key. See
Internet Engineering Task Force (...
user164070
7
votes
1
answer
2k
views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
- 2,809