Intermediate LevelWeb Security & Cyber Defense
What is TLS Certificate Pinning and why is it used in mobile applications?
❓ Interview Prompt: Explain Certificate Pinning, hardcoding public key hashes (Public Key Pinning), preventing MitM attacks by compromised CAs, and pin rotation.
Mobile applications communicating over standard HTTPS trust any certificate signed by a built-in OS Certificate Authority (CA). If an attacker installs a custom CA on a device (or a CA is compromised), they can execute Man-in-the-Middle (MitM) attacks!
Certificate Pinning Solution:
Mobile apps hardcode the SHA-256 hash of the server's Public Key inside the app binary:
•
During TLS handshake, the app verifies that the server's public key matches the pinned hash. If not $\rightarrow$ Connection aborted immediately!
Code Implementation Example
json
// Mobile App Certificate Pinning Configuration
{
"pinnedDomains": {
"api.example.com": {
"publicKeys": [
"sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
"sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=" // Backup backup pin!
]
}
}
}💡Certificate pinning public key SHA-256 hash configuration.
🎯 Interview Key Takeaway
Use Certificate Pinning in mobile applications to protect against MitM attacks from compromised Certificate Authorities.
#Certificate Pinning#Mobile Security#TLS#Intermediate
Back to all Web Security & Cyber Defense Questions→