SSL pinning (certificate pinning) is a security technique that hardcodes the expected certificate or public key of a server in the client application. This prevents attackers from using forged certificates, even those signed by trusted CAs.

Should I pin the certificate or the public key?

Pin the public key (SPKI hash). Public key pinning survives certificate renewals as long as the same key pair is used, while certificate pinning breaks every time a certificate is renewed. Always include backup pins for rotation.

📌 Γεννήτρια SSL Pinning

Δημιουργήστε διαμορφώσεις SSL pinning για Android και iOS

Οδηγός Στρατηγικής Pinning

Πιστοποιητικό Leaf

High security, but changes frequently (e.g. every 90 days). Requires app updates before every expiration.

Ενδιάμεση CA

Recommended. Changes rarely (years). Good balance between security and maintenance.

Root CA

Μέγιστη σταθερότητα (10-20 έτη). Εμπιστοσύνη σε όλα τα πιστοποιητικά που εκδίδονται από αυτή τη Root. Χαμηλότερη συντήρηση.

Οδηγός Εφεδρικού Pin

Για να αποφύγετε τη διακοπή της εφαρμογής εάν τα κλειδιά σας παραβιαστούν ή χαθούν, ΠΡΕΠΕΙ να συμπεριλάβετε ένα εφεδρικό pin. Δημιουργήστε ένα εφεδρικό ζεύγος κλειδιών εκτός σύνδεσης και φυλάξτε το με ασφάλεια.

1. Δημιουργία Εφεδρικού Ζεύγους Κλειδιών:

openssl genrsa -out backup_key.pem 2048

2. Εξαγωγή SPKI Pin:

openssl rsa -in backup_key.pem -pubout -outform der | openssl dgst -sha256 -binary | openssl enc -base64

SSL Pinning Generator creates certificate pinning configurations for mobile apps associating hosts with expected public keys, preventing MITM attacks even when a CA is compromised.

Key Facts

Chrome removed HPKP in 2018 due to deployment risks
Mobile apps widely use certificate pinning for API security
Certificate Transparency logs reduce need for browser pinning
Always include a backup pin for disaster recovery

Frequently Asked Questions

What is SSL pinning?

Hardcodes expected certificate/public key in client app, preventing forged certificate attacks even from trusted CAs.

Should I pin the certificate or public key?

Public key — survives certificate renewals. Certificate pinning breaks on every renewal. Always include backup pins.

What happens if I rotate my certificate?

If pinning the certificate, app breaks until updated. Use public key pinning with backup pins for safe rotation.