Communication over public networks requires secured data transfer. To do so, SSL/TLS certificate is an ideal way to encrypt such communication between the server and the browser. SSL protocol uses a digital certificate to authenticate and encrypt communication. Even browsers and servers keep a list of root certificates of trusted certificate authorities for higher compatibility. There is a danger of a man-in-the-middle attack during chain verification, and to avert it, a certificate pinning idea was developed. We will discuss certificate pinning, benefits, and issues in this article.
History of Certificate Pinning:
Google in 2011 started using certificate pinning, and chrome was directed to accept only pinned certificates when it tries to connect to google.com. If an attacker tries to mimic a trusted CA, chrome will distrust that certificate; as a result, the connection will not be made. After implementing Firefox and Chrome, other devices, and technologies, including IoT devices, mobile apps, and different software apps, started to adopt certificate pinning. Certificate pinning was disgraced due to its agility cost. The connectivity to applications may be lost due to certificate pinning. Also, if the pinning is not set correctly, it can block your website.
What is Certificate Pinning?
Certificate pinning is a technique that reduces the risk of a man-in-the-middle attack, compromise of certificate authorities, mis-issuance of a certificate that accepts only authorized certificates for the client and browser connections.
Mostly pinning is done on public keys and trusted certificate authorities. Applications used to pin x.509 certificate. Certificate pinning allows only pinned certificates rather than any trusted certificate. If any authorized certificate rather than a pinned certificate is, it will directly be refused.
How Does Certificate Pinning Work?
Certificate pinning is a straightforward process in which a host is associated with the predesignated certificate or public key that obeys x.509 cryptography standards. If a client or API wants to make a secure connection, a pinned certificate should be in the pinned certificate list. Often, developers integrate pinning certificates in application development to avert a would-be attack. Even certificates can be added during key continuity- a process where an application tries to connect.
What can go wrong with Certificate Pinning?
Certificate pinning with HTTP Public Key Pinning (HPKP) can be risky as wrong pinning can prohibit your website or cause loss of connectivity in your application. Few below issues make certificate pinning risky.
Key compromise
Certificate pinning along with HPKP only considers predefined public key certificates for 60 days. However, many sites do not keep backups of a key. The site would be vulnerable to a single key usage in such circumstances. As per industry standards, Certificate authorities revoke compromised certificates. If your pinned key is compromised, the clients will not recognize the new certificate and only remember the earlier pinned certificate. Thus, a connection will not be possible with certificate pinning.
Hacking
Once the HPKP policy is set for any website, it is hard to fix it. Suppose a hacker takes access to the server and sets a fake HPKP policy within a long-term period. Browsers can not establish a connection. Even at the time of resecure server, the effect of the earlier HPKP policy will remain.
Certificate Revocations
Certificate authorities revoke the certificate due to misspelling or any invalid entry in subject name or OU fields. The CA takes five days in the revocation process. If you have pinned your certificate in the client code, it is hard to update the new certificate for all your clients in just 5 days.
From the above-discussed situations, certificate pinning seems harmful rather than safe. Even Google and Firefox have removed pinning after a few years of launching due to denial-of-service and hostile pinning attacks. The main difficulty is the brief time you need to make changes like key changes, issuers, CA vendors, and certificates for your clients. If you have been given lifetime support for an application and your certificate is pinned, it is hard to provide updates to your pinned certificate. Many certificate authorities prohibit the usage of public-key pinning due to its complexities.
Which Certificates Can Be Pinned?
Application owners can choose to pin all three roots, intermediate and leaf certificates instead of pinning a single certificate. Application developers, therefore, try to pin all three certificates in a chain of trust. The main disadvantage of a single certificate pinning is that a hacker can benefit from leveraging a certificate from the same CA and take advantage of this loophole.
Root Certificate
Root CA issues a root certificate equipped with public and private keys and made of standard hashing and cryptographic algorithms.
Intermediate Certificate
An intermediate certificate lies in the center of a chain certificate as it is an intermediary between the root and leaf certificate.
Leaf Certificate
Leaf certificate carries higher trust in chain certificate. It is also named an end-entity certificate and requires timely updates and revocation by the CA.
Recommended: Root Certificates vs Intermediate Certificates
What Are the Benefits of Certificate Pinning?
Certificate pinning offers protection against a remote man-in-the-middle attack, compromised certificate authorities and invalid issuance of a certificate, CA mistakes, reverse engineering, thwart unauthorized malware on the device.
What Are the Problems with Certificate Pinning?
Besides earlier discussed issues in certificate pinning, there are other drawbacks. Certificate pinning does not help provide integrity of network communication as SSL does. It does not help in the compromised private key of a pinned certificate. It does not protect the jailbroken device or rooted device. It does not avoid reverse engineering.
Conclusion for Certificate Pinning
This post focuses on the TLS certificate, certificate pinning and its benefits and disadvantages and the issue of trust in CA. Before applying certificate pinning, it is necessary to implement TLS properly. Certificate pinning is the defense-in-depth strategy and should be implemented before checking certain criteria like the level of sensitive information, the effect of compromised CA on your application, organization’s ability to manage overhead expenses.
