CODEWITHSUNDEEP
androidiossslssl-certificate
Ryan
Ryan

Reputation: 5546

Using a self signed certificate with my app

I have a mobile app which accesses web services at https://myserver.com/mywebservice.

If I create a self signed certificate and I put it on my server, when the mobile app accesses the web service it sees the certificate but it doesn't recognize it as it is self signed. But in this case if I have a "man in the middle" attack, the attacker can create it's own certificate, so the app sees the certificate and again it doesn't recognize it.

Question: When you use a certificate like those from goDaddy, is iOS or Android programmed to trust goDaddy certificates in order to work, so the fake certificate that the attacker uses is considered invalid? So if I make the app trust my certificate, I can use my self signed certificate the same way?

Also How can I know which certificates are trusted by iOS or Android?

Upvotes: 2

Views: 2668

Answers (1)

Nikolay Elenkov
Nikolay Elenkov

Reputation: 52936

Generally your app or the OS needs to trust the CA that issued the server certificate for this to work. If it is issued by a CA whose certificate is pre-installed, things just work. If not, you need to either install the CA in the OS trust store or modify your app to to trust it. It doesn't really matter who created the certificate, VeriSign or goDaddy certs are no more 'special' than your self-signed ones.

As for getting a list of trusted certs, Android 4.x and later lists those in Settings->Security->Trusted Credentials. For earlier version you have to write some code to enumerate them. Don't know about iOS.

Upvotes: 1

Related Questions