CODEWITHSUNDEEP
iosssl
Matrix
Matrix

Reputation: 7613

what charles or any middle man see when we have implemented SSL pinning between client and server?

what charles or any middle man see when we have implemented SSL pinning between client and server ?

i know bit of about what is SSL pinning, how to implement it in app and server side. but i am not clear about how middle man views SSL pinning ? what kind of requests middle man see in this case ? and why it is not able to get information from request ?

Upvotes: 0

Views: 85

Answers (1)

Steffen Ullrich
Steffen Ullrich

Reputation: 123375

If pinning is properly implemented the MITM will see the original TLS ClientHello from your device which likely includes the target hostname and it will get from the target server the leaf and chain certificates. After the MITM tries to send newly created certificate to the client the client should just close the connection since the certificate is not the expected one, i.e. no actual application data are transferred but only the meta data.

Upvotes: 1

Related Questions