1
$\begingroup$

We are doing an iPhone app and read multiple forums which says SSL pinning makes it possible to avoid man in the middle as we trust our web services server through the certificate which will be pre bundled along with our app to appstore.

How can i protect the certificate ? We tried storing inside the app in base 64ed DER format but the string commands on the binary executable prints that data. Is there a way where the certificate is hidden from the attacker so that the IPA file is not vulnerable from giving up the certificate.

Improve this question
$\endgroup$
7
  • 5
    $\begingroup$ Why would you want to keep the certificate secret? You only need to keep the private key... well, private. $\endgroup$
    – yyyyyyy
    Commented Aug 6, 2015 at 14:57
  • 1
    $\begingroup$ In general, there is no reason to hide a certificate. It only enables trust in the public key of the server, but it doesn't contain any kind of secret information, so it could be public. $\endgroup$
    – cygnusv
    Commented Aug 6, 2015 at 15:03
  • 1
    $\begingroup$ this article may help. You pin the public key. See also this answer on Security.SE. $\endgroup$
    – mikeazo
    Commented Aug 6, 2015 at 15:33
  • 2
    $\begingroup$ You only need to validate that the client received the correct cert. The server won't send the private key so that can't be part of what the client validates. Consider just using a hash or thumbprint. $\endgroup$
    – bmm6o
    Commented Aug 6, 2015 at 16:06
  • 3
    $\begingroup$ Just so you know, if you're trying to keep the user from being able to read the traffic it's pretty much a lost cause. Pinning won't keep someone from reverse-engineering the code. $\endgroup$
    – cpast
    Commented Aug 6, 2015 at 22:43

1 Answer 1

Reset to default
1
$\begingroup$

You don't need to hide the certificate at all. The certificate only contains the public key and additional info of the owner (in this case the server). It shouldn't contain any private information. What you need to do is to store the certificate in such a way that you can trust the origin of the certificate.

So what you need to think about is certificate management. For instance, what happens if you need to replace the certificate? Is an update of the software enough?

The private key is not part of the certificate. This may not be obvious from certain API's such as the Microsoft API. You must make sure that you only export the X509 certificate(s) excluding the private key. If you are exporting a PKCS#12 (PFX) file then you may be doing something wrong.

The key pair should be generated on the system where you intend to use the private key. Access to the private key should be kept to an absolute minimum. The public key and certificate may be distributed freely.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.