1
$\begingroup$

We are doing an iPhone app and read multiple forums which says SSL pinning makes it possible to avoid man in the middle as we trust our web services server through the certificate which will be pre bundled along with our app to appstore.

How can i protect the certificate ? We tried storing inside the app in base 64ed DER format but the string commands on the binary executable prints that data. Is there a way where the certificate is hidden from the attacker so that the IPA file is not vulnerable from giving up the certificate.

$\endgroup$
  • 5
    $\begingroup$ Why would you want to keep the certificate secret? You only need to keep the private key... well, private. $\endgroup$ – yyyyyyy Aug 6 '15 at 14:57
  • 1
    $\begingroup$ In general, there is no reason to hide a certificate. It only enables trust in the public key of the server, but it doesn't contain any kind of secret information, so it could be public. $\endgroup$ – cygnusv Aug 6 '15 at 15:03
  • 1
    $\begingroup$ this article may help. You pin the public key. See also this answer on Security.SE. $\endgroup$ – mikeazo Aug 6 '15 at 15:33
  • 2
    $\begingroup$ You only need to validate that the client received the correct cert. The server won't send the private key so that can't be part of what the client validates. Consider just using a hash or thumbprint. $\endgroup$ – bmm6o Aug 6 '15 at 16:06
  • 3
    $\begingroup$ Just so you know, if you're trying to keep the user from being able to read the traffic it's pretty much a lost cause. Pinning won't keep someone from reverse-engineering the code. $\endgroup$ – cpast Aug 6 '15 at 22:43
1
$\begingroup$

You don't need to hide the certificate at all. The certificate only contains the public key and additional info of the owner (in this case the server). It shouldn't contain any private information. What you need to do is to store the certificate in such a way that you can trust the origin of the certificate.

So what you need to think about is certificate management. For instance, what happens if you need to replace the certificate? Is an update of the software enough?

The private key is not part of the certificate. This may not be obvious from certain API's such as the Microsoft API. You must make sure that you only export the X509 certificate(s) excluding the private key. If you are exporting a PKCS#12 (PFX) file then you may be doing something wrong.

The key pair should be generated on the system where you intend to use the private key. Access to the private key should be kept to an absolute minimum. The public key and certificate may be distributed freely.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.