Your app pins the server's public key, and your security policy rotates the server certificate and key on a schedule. How does the client learn the new public key, so users on the old app version aren't all cut off right after a rotation?
Pin the SPKI (public key) hash instead of the leaf certificate, and put the current key together with backup keys you created in advance into the pin set, so an old app already knows the key when the server switches to a backup.
SecurityShort answerAdvanced
How would you implement certificate pinning (SSL pinning) on iOS?
#certificate #public-key
SecurityMultiple choiceBasics
What conditions have to hold before a tool like Charles or Proxyman can show an app's…
#pinning #certificate
SecurityMultiple choiceBasics
An app pins by hardcoding the SHA-256 hash of the leaf certificate. What happens first…
#rotation
SecurityShort answerExpert
QA reports that with a Charles proxy in place they see every API request and response…
#pinning