3 ms·

It's hardly doable in practice. For example, certificates have to be updated at least yearly, leaving your app completely broken unless updated.

tialaramex 8y ago
1a. You don't have to pin the leaf. You can pin an intermediate 1b. Or you can pin the public key and ignore the certificate altogether, new certificates for the same key can be obtained as necessary. 2. The maximum certificate lifetime is currently 825 days, which, unless you're on another planet, is not "yearly". 3. If you're pinning for an application (not a generic website accessible in browsers) you don't need a certificate from the Web PKI at all, you can mint your own, ignore the lifetime rules, write Emoji in the Common Name field, use a different RSA exponent, the world is your oyster.
- tinus_hn 8y ago
  Clever but if you try tricks like that you can’t use the system libraries which is rather inconvenient.
  - conradev 8y ago
    As far as I know, all of the above is possible to implement with the hooks that the system provides, at least on iOS.
    - tinus_hn 8y ago
      If you submit an app you have to set a flag indicating what kind of communication you’re going to use. If it’s not a secure connection using valid certificates you have to use the ‘insecure connection’ flag and that will cause extra review steps. If there’s no good reason you’ll be denied.
- user5994461 8y ago
  1a. You can't control what root/intermediate will be used by your certificate supplier one year from now. 1b. You should not reuse private keys between certificates and never for intermediate or root. 2. It's yearly or 2 years for the most common suppliers. 3. Have fun getting your certificate accepted from every device and operating system. Anyway. I am not saying that it can't be done, I'm saying that there are a lot of challenges to doing it properly and any mistake will make the app completely broken.
  - conradev 8y ago
    > Have fun getting your certificate accepted from every device and operating system. You have full control in a native iOS app over which certificates you accept or reject. Which is why the author specified that the trick would work if the endpoint is just for apps.

tialaramex 8y ago

1a. You don't have to pin the leaf. You can pin an intermediate 1b. Or you can pin the public key and ignore the certificate altogether, new certificates for the same key can be obtained as necessary. 2. The maximum certificate lifetime is currently 825 days, which, unless you're on another planet, is not "yearly". 3. If you're pinning for an application (not a generic website accessible in browsers) you don't need a certificate from the Web PKI at all, you can mint your own, ignore the lifetime rules, write Emoji in the Common Name field, use a different RSA exponent, the world is your oyster.

tinus_hn 8y ago
Clever but if you try tricks like that you can’t use the system libraries which is rather inconvenient.
- conradev 8y ago
  As far as I know, all of the above is possible to implement with the hooks that the system provides, at least on iOS.
  - tinus_hn 8y ago
    If you submit an app you have to set a flag indicating what kind of communication you’re going to use. If it’s not a secure connection using valid certificates you have to use the ‘insecure connection’ flag and that will cause extra review steps. If there’s no good reason you’ll be denied.
user5994461 8y ago
1a. You can't control what root/intermediate will be used by your certificate supplier one year from now. 1b. You should not reuse private keys between certificates and never for intermediate or root. 2. It's yearly or 2 years for the most common suppliers. 3. Have fun getting your certificate accepted from every device and operating system. Anyway. I am not saying that it can't be done, I'm saying that there are a lot of challenges to doing it properly and any mistake will make the app completely broken.
- conradev 8y ago
  > Have fun getting your certificate accepted from every device and operating system. You have full control in a native iOS app over which certificates you accept or reject. Which is why the author specified that the trick would work if the endpoint is just for apps.