I'm working on a product with strong security. Essentially there is an App, downloaded from the iTunes App Store. When the App starts up, it generates a strong RSA keypair and stores it in the Keychain. This key pair is the foundation for a lot of things in the overall system. The next step is for the App to use this keypair to generate a CSR (Certificate Signing Request) and present it to a CA (Certificate Authority) and request an SSL Client Certificate for the App key pair. The CA then records the UUID of the App. This process needs to be secured so that only the validated App can submit the CSR.
My question is how do I authenticate my App to the CA, to prevent something else to request these Client Certificates? I understand that we cannot rely on the certificate alone for security. Its only purpose is to prevent a layer of security between the App and the backend system and a "anchor" for User Security (outside the scope of this question).
Logic dictates that we should "give" the App something that only the App knows (i.e. a secret, encrypted and obfuscated in code). But this can be extracted with enough time and effort, thereby unlocking access to the CA.
Essentially I want to know how I can authenticate a piece of code.
Currently, our thinking is to generate a unique key pair at build time, embed the public key in the code (obfuscated) and use the public key to encrypt the CSR. The private key is in the backend. This ensures that only entities with the public key can submit the CRs.
Note - this process has no user intervention. It is not about the user, only about securely generating an identity unique for an instance of an App and issuing a certificate