Android Question Beginners guide to https SSL certificate pinning.

[Reminisce]

Hello guys, I need to securely communicate with my rest api on a Mobile banking app I'm working on. I already have some security in place but I need to pin my SSL certificate inside my app, so I can prevent [MAn in the middle attacks] . I need a A~Z guide on how to go about this. A quick search on the forum returned this https://www.b4x.com/android/forum/threads/okhttp-set-parameter-with-inline-java.64748/

But, I really don't understand that thread.
Thanks.

 

[Erel]

Regular, simple, properly configured SSL is protected from man in the middle attacks. You don't need to do anything special.

 

[Reminisce]

Regular, simple, properly configured SSL is protected from man in the middle attacks. You don't need to do anything special.

Are you talking about just using "https://abc.com" instead of "http://abc.com"?

I saw some articles online that talked about Certificate pinning and how hackers can intercept my app's communications using a fake certificate. That' was why I opened this thread. Is there a way I can pin the SSL certificate inside the app? This way I can be rest assured of my app's integrity.

 

[Erel]

This is not needed. You should understand how SSL works.
Unless you are initializing OkHttp with TrustAll it will reject fake certificates.

 

[Reminisce]

@Erel, So this means as soon as I install the SSL certificate on my web server and I call the rest link with "https" inside my app,everything is under control and secured?
thank you so much for that clarification. This is my first time using https inside my app.

B4x products are amazing, You're very much appreciated.

 

[Reminisce]

This is the article I was talking about.

 

[Erel]

this means as soon as I install the SSL certificate on my web server and I call the rest link with "https" inside my app,everything is under control and secured?

Yes, assuming that you haven't used the "trust all" feature. For this to work the certificate should be signed by an authorized provider.

This is how browsers work.

 

[Reminisce]

Yes, assuming that you haven't used the "trust all" feature. For this to work the certificate should be signed by an authorized provider.

This is how browsers work.

Thanks a lot for your time sir.

Thread closed.