Category Archives: Certificate Pinning

• Let’s assume that we have a client application talking to a server via SSL.
• Let’s also assume that the client is using SSL certificate pinning, i.e. the client will refuse the server certificate unless it conforms to a specific hard coded one the client was released with.

As certificates have expiration dates, the pinned certificate of the server will eventually have to be replaced. This process generally calls for some application/client side update to make the client aware of the new certificate ‘to pin’.

Are there best-practices on how this transition/change can be managed?

I’m thinking of something more sophisticated than two people pressing a button at the same time (i.e. the server cert being updated and the application forcing the user to update)… The organisational processes involved here can be non-trivial, especially since the release and maintenance cycles of client/server/operations might be running according to different schedules and priorities.

Maybe something like (I’m just writing down a rather naive approach here):

• Client has multiple certificates stored for the server, with different but overlapping validity periods.
• If one pinned certificate is expired the client checks if he has a different still valid one…

–> This would allow new ‘pinned’ certificates for a server to be delivered well in advance of actually switching certificates on the server.

Continue reading SSL Pinning: Managing changes in the pinned certification on client side→