Questions tagged [certificate-pinning]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
34 views

Request to produce Android APK without 'certificate pinning'

Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
user avatar
  • 111
1 vote
0 answers
43 views

Insufficient SSL certificate pinning in an native Android app

I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed: Converted .crt file to .bks file Added the .bks file to the asset folder in project structure ...
user avatar
0 votes
1 answer
387 views

Intercepting app with Burp shows no requests

I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop. But no ...
user avatar
9 votes
3 answers
4k views

Can we prevent SSL Pinning Bypass by pinning key instead of certificate?

I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be ...
user avatar
  • 201
0 votes
1 answer
165 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
user avatar
  • 33
0 votes
1 answer
81 views

Public Key Pinning Attack? [duplicate]

I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
user avatar
0 votes
1 answer
109 views

If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?

I have some questions about certificate pinning. Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
user avatar
  • 1
1 vote
1 answer
305 views

Can't log in into Twitter for Android app after SSL Bypass

I don't know if this is the right forum for this kind of question. I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
user avatar
  • 21
1 vote
1 answer
111 views

Is certificate pinning enough to protect client (native mobile app) - server communication?

My use case is the following: I want to create an app with React Native that I can deploy on both iOS and Android. The app should consume an RSS feed (https call) from the server but there is no need ...
user avatar
  • 295
9 votes
1 answer
2k views

Certificate Pinning Best Practice or Alternative

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...
user avatar
  • 165
4 votes
3 answers
241 views

How can you bind a public key to a certificate if the public key depends on the choice of algorithms?

Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
user avatar
  • 47
0 votes
1 answer
124 views

How can I locate and purchase SSL certificates that contain a specific trust chain?

I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which ...
user avatar
0 votes
0 answers
104 views

Using application encryption instead of relying on HTTPS

I use Google Firebase Services. I am thinking about using only https on mobile to send and receive a payload from my server. I will have RSA encryption with a public key on all clients. So when a ...
user avatar
0 votes
1 answer
92 views

How to pin public root key when downloading an image with docker pull (Docker Content Trust)?

How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
user avatar
0 votes
1 answer
204 views

Force public key collision to break certificate pinning

I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol. I already tried to set up a simple MITM ...
user avatar
  • 13
1 vote
2 answers
243 views

Forge certificate for man in the middle attack

I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
user avatar
  • 13
2 votes
1 answer
103 views

Does a certificate with extended validation provide better security than certificate pinning?

It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.
user avatar
5 votes
2 answers
8k views

Is there no way to bypass certificate pinning without patching apps?

Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
user avatar
  • 153
6 votes
2 answers
2k views

HTTP Public Key Pinning vs Certificate Transparency, which is better and why?

We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well. The ...
user avatar
  • 161
1 vote
1 answer
350 views

Rotating TLS Certs used with Public key Pinning

I have an app which connects to an API. The API TLS certificate is about to expire and we are using Public key Pinning. How do I rotate the certs without disabling access to our users? When ...
user avatar
0 votes
1 answer
628 views

Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?

I have an iOS app with certificate pinning to two different servers. I want to test this certificate pinning with a MITM attack, so I did: Set proxy at my PC, in macos wifi settings -> advanced -> ...
user avatar
-1 votes
2 answers
2k views

Trying to extract SSL client certificate from android app

I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate. ...
user avatar
1 vote
1 answer
364 views

Higher risk of no certificate pinning on mobile apps vs web apps?

Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But i rarely see people mentioning it for web applications. The ...
user avatar
  • 111
1 vote
0 answers
1k views

Charles Proxy intercepting SSL Pinning enabled traffic

An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
user avatar
  • 11
6 votes
3 answers
4k views

Certficate pinning: should I pin the leaf or intermediate?

I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp. As our app clients do not update their app regulary I don't want to take the risk ...
user avatar
  • 185
4 votes
2 answers
268 views

Is pinning global root CA almost same as not having any certificate pinning at all?

I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all? ...
user avatar
1 vote
1 answer
95 views

A query about SSL pinning [duplicate]

So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network ...
user avatar
2 votes
2 answers
2k views

Mutual TLS and Cert Pinning solving the same problem?

To prevent MITM from my app I will use cert pinning. To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources. ...
user avatar
  • 1,182
0 votes
1 answer
122 views

Can certificate pinning be achieved strictly at the network layer?

With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
user avatar
1 vote
0 answers
137 views

Certificate pinning for device firmware signing

What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
user avatar
  • 11
3 votes
1 answer
1k views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
user avatar
2 votes
1 answer
884 views

Does SSL inspection break applications utilizing certificate pinning?

A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
user avatar
  • 412
2 votes
2 answers
2k views

Why does pinning a CA root certificate not present a security risk?

AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
user avatar
  • 412
2 votes
1 answer
579 views

Use subject key identifier for certificate pinning

As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server. ...
user avatar
1 vote
1 answer
501 views

Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?

I'm analysing an iOS application and its communications through Charles. I have access to most of SSL communications but not all, due to certificate pinning. I know that there are many different ways ...
user avatar
0 votes
1 answer
1k views

More clarity on Certificate, public key, hash

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below. I've used below command to see what this certificate ...
user avatar
0 votes
0 answers
313 views

Proxying an Android application with Burp Suite

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...
user avatar
  • 123
1 vote
1 answer
362 views

Mutual SSL for clients of SaaS cloud service

My company is launching cloud based SaaS service. There will be clients from different tenants connecting to our services via mutual SSL. The clients would use a library provided by us to connect to ...
user avatar
3 votes
2 answers
6k views

Does a public key stay the same when a certificate is renewed? [duplicate]

So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values. The rationale for this lay in the fact that we were told that ...
user avatar
3 votes
2 answers
643 views

Configuration for Windows account mapped to IIS certificate authorization

I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs. On the Windows machine, I ...
user avatar
  • 83
2 votes
4 answers
2k views

How do mobile apps prevent HTTPS MITM attacks when the user installs the attacker's CA certificate?

I am using a mobile app that installs a fake trusted CA certificate and therefore can capture the HTTPS traffic of other apps. Most of the time, this MITM attack is successful. However, I noticed ...
user avatar
1 vote
1 answer
743 views

Robust SSL pinning on IoT device with Let’s Encrypt

I would like to implement SSL pinning on ESP8266. Since leaf certificate is changing quite often I would like to check for which domain leaf was issued and check that root belong Let’s Encrypt. To ...
user avatar
  • 247
1 vote
0 answers
576 views

IRC client with ability to verify server's self-signed cert fingerprint [closed]

I'm playing around with UnrealIRCd on CentOS. Just went through the config and compiling and got the ircd up and running. When I go to connect to it via HexChat I can only get through by checking the ...
user avatar
  • 41
0 votes
2 answers
1k views

Can lack of certificate pinning be considered a vulnerability?

The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it ...
user avatar
1 vote
0 answers
146 views

How do I intercept packages in a Facebook application?

I can not listen to HTTPS traffic in the Facebook application through Fiddler and Burp. SSL-Pinning is disabled through SLL Kill Switch 2 (other applications such as Twitter, Snapchat with SSL-Pinning ...
user avatar
1 vote
2 answers
752 views

Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?

I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)? Because with HPKP ...
user avatar
  • 6,200
3 votes
1 answer
1k views

Should Subject Public Key Information be the same in 2 different certificates created from the same CSR?

Recently, I've worked on setting certificate pinning for our mobile app. I'm using the hash of the Subject Public Key Information (SPKI) for the pinning. Now, I was under the impression that SPKI will ...
user avatar
1 vote
1 answer
418 views

Certificate Pinning with CDN

I'm currently designing the security controls of an Android Application and willing to have Certificate Pinning. I'm familiar with the concept and have seen various implementations in the past, yet ...
user avatar
4 votes
1 answer
443 views

How are pinned keys stored in the browser? How about performance with large lists?

Public-key pinning is a proposal that allows sites to pin their keys in the browser to protect against Man In The Middle attacks that try to forge a site's key. See Internet Engineering Task Force (...
user avatar
7 votes
1 answer
2k views

iOS & Android Certificate Pinning with Lets Encrypt

We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for. We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
user avatar
  • 2,809