New answers tagged


Now if the mobile application is trusting any certificate issued by Digicert then you can effectively MiTM? Am I missing something? Pinning against a CA does not mean that every certificate from this CA will be trusted for a site but that only certificates issued by this CA will be considered to be trustable in the first place. CA pinning does not disable ...


Pinning a Root CA can prevent risks posed by other trusted Root CAs in the default certificate store. As mentioned in the link you shared (thank you), it's a deployment decision as to how high (or low) in the chain you would pin the certificate. Check out this Security.SE post for more information for the underlying threat and some mitigations.


Say, I am interacting with Google. Firefox shows me their certificate details. If I were to be able to try out a MITM for a request to Google, can't I just copy Google's certificate(which seems to be a public information) and provide that as my certificate? You can copy the certificate all you want, but you can't copy the private key that corresponds to the ...

Top 50 recent answers are included