SSL Certificate pinning: Key Takways

There was a good discussion on OWASP-Leaders mailing list [0] some time ago regarding SSL certificate pinning in applications. 

I thought of summarizing a few key points to consider while opting for certificate pinning: 
  1. You can pin multiple certificates (If one is compromised, you can start using another pinned cert)
  2. You can pin public key/s (hence *any* certificate the server creates with the corresponding private key will still work)
  3. You can pin the public keys of trust chain/CAs (useful in incidents like Hearbleed where private keys were compromised)
  4. Consider update mechanism while implementing pinning (If you are pinning a cert/key in an updater process)
The developer needs to choose a recipe of one or more the above points to build an efficient, secure, and scalable design.

Please chime in with your comments and suggestions and I would be happy to update this post.


Related Posts
« Prev Post