AFNetworking SSL Pinning Expired Certificates

Question

How do you update expired ssl certificates if ssl pinning is used on ios apps? It seems like only an app update would enable updating the certificate but then users who don't update the app will not receive this update.

Schlenger

Answer 1

The key is to understand the possible values for AFSecurityPolicy's pinningMode.

AFSSLPinningModeCertificate means that the certificate provided by the server must match exactly one of the pinned certificates, which by default are the certificates in your app bundle. This is the mode you are currently using.

AFSSLPinningModePublicKey means that the certificate provided by the server must contain the same public key as one of the certificates pinned by your app.

If you use AFSSLPinningModePublicKey and renew (update) your server certificate with the same keypair, your iOS app will continue to work without modification.

Gerita

Are you sure AFSSLPinningModePublicKey means that the server must have been signed by the same key, as opposed to having the certificate contain the same public key as the reference one (which would generally make more sense)? – Salutary

@Salutary Thanks, I've amended the explanation to make it clearer. – Gerita

No worries, good answer anyway, I was actually just looking at the bottom of the file you linked to, it said indeed "Validate host certificates against public keys of pinned certificates.". – Salutary

what about if you have to change the key upon renewing the certificate? – Schlenger

If you change the key, the certificate won't match for either pinning mode, and you'll have to get your users to update the app. – Gerita

Is it true that AFSSLPinningModePublicKey does not check the expiration date of the bundled certificate? I'm having trouble determining if this is the case as you seem to have indicated. – Peon

One would assume so – the idea with public key pinning is that new certificates can be issued and deployed to a server, and old clients continue to function. – Gerita

Answer 2

To address the second part of the question, yes users with old versions will be locked out.

To lower the impact, a common strategy is to include the new certificate alongside the soon to be expired certificate. This gives users a few 'buffer' versions they can be on and still have access after the changeover.

Ebby