Questions tagged [certificate-pinning]
The certificate-pinning tag has no usage guidance.
104
questions
0
votes
1
answer
78
views
Using mTLS for API access control and authentication
my question is about using mTLS for API access control and authentication.
I understand in mTLS, both the server and client (making the API request) will verify each other's identity. This allows the ...
- 3
1
vote
1
answer
185
views
Can a VPN company perform a MiTM attack if SSL Pinning is in place?
Recently, I read news about Facebook acquired the Onavo VPN company to monitor Snapchat users' traffic. It seems they executed a Man-in-the-Middle attack by replacing the certificate. But could they ...
- 13
0
votes
0
answers
66
views
Will this certificate Pinning plan work as expected?
I have a mobile app deployed to millions of user in both Android and iOS.
My Security dpto rotates our certs once a year.
Our certs are issued by GlobalSign.
I would like to pin the certificate ...
- 119
0
votes
0
answers
245
views
Router level SSL Inspection
Is there any way I could inspect the traffic from an untrusted device connected to my network? I would like to get a router that has ssl inspection capabilities, where I could check the https packets ...
- 1
1
vote
2
answers
285
views
How can I enhance the security of SSL pinning in my mobile app to prevent certificate exposure?
For example, let's say my backend address is api.xyz.com, and I have a mobile application. This application sends requests to api.xyz.com. The application employs SSL pinning, where it pins the ...
0
votes
0
answers
689
views
How to get Certificate's Subject Public Key from CSR
I am currently using this code to have the public key pinning
OkHttpClientFactory okHttpClientFactory = () -> {
CertificatePinner certificatePinner = new CertificatePinner.Builder()
...
- 101
0
votes
1
answer
424
views
Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?
I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory.
Then built a client app that is an executable, then pinned the public key hash for ...
- 103
2
votes
1
answer
300
views
Benefits of certificate pinning to leaf with intermediate as a backup?
According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup.
Any security measure is only as good ...
- 121
0
votes
0
answers
275
views
SSL/x509 certificate/public key expiration [duplicate]
I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
- 1
2
votes
0
answers
277
views
Public Key Certificate Pinning alternatives
In the domain of mobile application, certificate pinning topic is still relevant. I am trying to get opinions on best alternatives, because certificate pinning needs the storage of public keys within ...
- 121
2
votes
1
answer
3k
views
Is SSL pinning bypass considered a vulnerability? If yes, what are the tightening/solution suggestions?
I'm a pentester and this is my first question here. I've managed to circumvent the ssl certificate pinning implementation on a few mobile apps.
Frankly, the applications I test are critical bank ...
- 35
1
vote
1
answer
547
views
How can authoritarian governments sniff TLS encrypted traffic on mass scale?
I tried sniffing TLS web traffic on my own network and I always run against the following complications:
I need to install an additional root cert on my devices
I need to root my phone to do ...
- 1,152
0
votes
2
answers
351
views
Could certificate pinning work if one checks the intermediate certificate when the leaf certificate already expired?
I have the following scenario:
When the leaf certificate expires, the intermediate certificate is checked and if the intermediate is not expired, the application will keep running and will not be ...
- 1
6
votes
1
answer
254
views
What is the best practice for relying parties to selectively trust certificates in a corporate pki hierarchy?
I have a pki infrastructure for internal company use.
In this pki there are multiple registration authorities whose responsibility is to.
receive certificate issuance requests
verify the identity of ...
0
votes
1
answer
812
views
Can I bypass SSL pinning If I found the certificate hardcoded in the application
I found an x509 certificate hardcoded in an application and after looking into the code I found that is used to validate certificates(SSL pinning). Can I bypass SSL pinning with the certificate that I ...
2
votes
0
answers
449
views
Request to produce Android APK without 'certificate pinning'
Information Protection Officer at my work requested me to produce a version of our Android App (quote) "...without SSL pinning for our.backend.domain.name.com" for vulnerability scanning ...
- 131
1
vote
0
answers
228
views
Insufficient SSL certificate pinning in an native Android app
I have implemented Certificate Pinning in a prototype of an android app. Here are the steps I followed:
Converted .crt file to .bks file
Added the .bks file to the asset folder in project structure
...
- 11
0
votes
1
answer
2k
views
Intercepting app with Burp shows no requests
I´m pentesting my first mobile application. I have a rooted android device and followed the steps here and here to install the certificate to proxy the traffic through Burp on my Laptop.
But no ...
9
votes
3
answers
10k
views
Can we prevent SSL Pinning Bypass by pinning key instead of certificate?
I have certificate pinning implemented in my iOS and Android apps. But when apps were pen-tested, we got the report from the pentester saying SSL implementation is weak in both the apps and can be ...
- 201
0
votes
1
answer
697
views
Should certificate pinning be implemented if the app can use many servers?
In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application.
The vendor sells software that it's customers ...
- 53
0
votes
1
answer
177
views
Public Key Pinning Attack? [duplicate]
I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
- 141
2
votes
2
answers
299
views
If a mobile app pins the Root Authority Certificate of a server and verifies its hostname, is it possible an attack via DNS-poisoning?
I have some questions about certificate pinning.
Supposing that a mobile application has pinned only the root CA, it should be possible to an attacker to redirect in some way the victim to a malicious ...
- 21
1
vote
1
answer
987
views
Can't log in into Twitter for Android app after SSL Bypass
I don't know if this is the right forum for this kind of question.
I was trying to intercept traffic from Twitter for Android app and for that I needed to bypass the SSL pin they implemented. ...
- 21
2
votes
1
answer
283
views
Is certificate pinning enough to protect client (native mobile app) - server communication?
My use case is the following: I want to create an app with React Native that I can deploy on both iOS and Android.
The app should consume an RSS feed (https call) from the server but there is no need ...
- 315
12
votes
1
answer
8k
views
Certificate Pinning Best Practice or Alternative
I'm looking for the "best practice" to use in Certificate Pinning or an Alternative.
Scenario: I have a native mobile app and I have pinned the certificate so that the app can validate ...
- 197
4
votes
3
answers
401
views
How can you bind a public key to a certificate if the public key depends on the choice of algorithms?
Can the same public key be used with RSA, Elliptic Curve, or other asymmetric encryptions algorithms? If not, how is a public key bound to a X.509 Certificate? Presumably, you'd have to know the ...
- 67
0
votes
1
answer
183
views
How can I locate and purchase SSL certificates that contain a specific trust chain?
I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which ...
- 103
0
votes
0
answers
145
views
Using application encryption instead of relying on HTTPS
I use Google Firebase Services. I am thinking about using only https on mobile to send and receive a payload from my server. I will have RSA encryption with a public key on all clients. So when a ...
1
vote
1
answer
290
views
How to pin public root key when downloading an image with docker pull (Docker Content Trust)?
How can I execute docker pull (with Docker Content Trust enabled) such that it fails if the image doesn't have a valid signature using the private key corresponding to (or subordinate to) the public ...
- 1,070
1
vote
1
answer
312
views
Force public key collision to break certificate pinning
I'm trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol.
I already tried to set up a simple MITM ...
- 23
1
vote
1
answer
594
views
Forge certificate for man in the middle attack
I'm trying to analyze a SSLv3 connection. The certificate of the server has a "MD5 with RSA" signature. So I was setting up a local man in the middle attack by setting up a local DNS server ...
- 23
2
votes
1
answer
202
views
Does a certificate with extended validation provide better security than certificate pinning?
It looks like certificates with extended validation provide better protection than certificate pinning, but I'm unsure about this.
5
votes
2
answers
13k
views
Is there no way to bypass certificate pinning without patching apps?
Can you do anything other than patching apps' compiled-code/cert-files (which is app-specific, requires manual analysis and patching + super-user/root) to intercept TLS traffic of apps that use ...
- 153
7
votes
2
answers
3k
views
HTTP Public Key Pinning vs Certificate Transparency, which is better and why?
We are rolling out a new mobile app. Our security team recommends us to pin the public key in order to avoid MITM. iOS already has CT checks and we can enable that for the Android app as well.
The ...
- 171
2
votes
1
answer
1k
views
Rotating TLS Certs used with Public key Pinning
I have an app which connects to an API. The API TLS certificate is about to expire and we are using Public key Pinning.
How do I rotate the certs without disabling access to our users?
When ...
- 671
0
votes
1
answer
1k
views
Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?
I have an iOS app with certificate pinning to two different servers.
I want to test this certificate pinning with a MITM attack, so I did:
Set proxy at my PC, in macos wifi settings -> advanced -> ...
- 103
-1
votes
2
answers
4k
views
Trying to extract SSL client certificate from android app
I'm trying to find out a specific request from an android application to its API server. Using Burp Suite, I get a handshake failure alert. Using fiddler it asks me to provide a custom certificate.
...
- 135
2
votes
2
answers
1k
views
Higher risk of no certificate pinning on mobile apps vs web apps?
Talking with people, it is frequently considered that having a mobile application without certificate pinning is a vulnerability. But I rarely see people mentioning it for web applications.
The ...
- 141
1
vote
0
answers
2k
views
Charles Proxy intercepting SSL Pinning enabled traffic
An Android application that has SSL Pinning was successfully tested on a mobile device running Android 6 (with the certificates installed) using Burp proxy and OWASP ZAP Proxy. As expected the ...
- 11
9
votes
3
answers
8k
views
Certficate pinning: should I pin the leaf or intermediate?
I'm following this article : Android Security: SSL Pinning to implement certificate pinning in Android using OkHttp.
As our app clients do not update their app regulary I don't want to take the risk ...
- 215
4
votes
2
answers
553
views
Is pinning global root CA almost same as not having any certificate pinning at all?
I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?
...
- 203
1
vote
1
answer
142
views
A query about SSL pinning [duplicate]
So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network ...
4
votes
2
answers
5k
views
Mutual TLS and Cert Pinning solving the same problem?
To prevent MITM from my app I will use cert pinning.
To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources.
...
- 1,294
0
votes
1
answer
167
views
Can certificate pinning be achieved strictly at the network layer?
With a client side java application that interacts with the server over http, is it possible to handle certificate pinning strictly at the network layer? Meaning, if the certificate is pinned on a ...
- 11
1
vote
0
answers
197
views
Certificate pinning for device firmware signing
What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
- 11
3
votes
1
answer
2k
views
Certificate Pinning for WebSockets
I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins.
I would like to know ...
2
votes
1
answer
2k
views
Does SSL inspection break applications utilizing certificate pinning?
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL ...
- 514
3
votes
2
answers
3k
views
Why does pinning a CA root certificate not present a security risk?
AWS recommends pinning their root certificate when implementing SSL pinning. My understanding is that SSL pinning for mobile applications mitigates a situation where an attacker has installed a ...
- 514
2
votes
1
answer
1k
views
Use subject key identifier for certificate pinning
As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server.
...
- 152
2
votes
1
answer
651
views
Defeat iOS Certificate Pinning by replacing the hardcoded certificate in the executable?
I'm analysing an iOS application and its communications through Charles.
I have access to most of SSL communications but not all, due to certificate pinning.
I know that there are many different ways ...
- 123