SSL pinning for Mobile applications, API is running in AWS Behind AWS ALB?
How can I implement SSL pinning in a mobile application when
- The API is hosted on AWS, behind an Application Load Balancer (ALB).
- The ALB is using an SSL certificate managed by AWS Certificate Manager (ACM).
Questions
- How do I perform SSL pinning in this scenario, given that the certificate is managed by ACM and served through ALB?
- What are the best practices for SSL pinning in mobile apps when the backend uses AWS ALB + ACM?
- Are there any limitations or challenges when using SSL pinning with certificates managed by ACM (e.g., certificate rotation)?
- Language
- English
asked a year ago343 views
- Newest
- Most votes
- Most comments
Hello.
As stated in the following documentation, I do not recommend using public certificates issued by ACM for SSL pinning.
https://repost.aws/knowledge-center/pin-application-acm-certificate
It's not a best practice to pin your AWS application to an SSL/TLS certificate issued by ACM. If you must pin your application to an ACM certificate, then pin your application to all available Amazon Trust Services root certificate authorities (CAs). Don't pin your application to an individual ACM certificate or intermediate CA. For more information, see Certificate pinning.
Public certificates issued by ACM are automatically renewed.
If you use SSL pinning, you will not be able to connect to your application when the certificate is renewed.
If you want to use SSL pinning, it is recommended that you use one of the methods described in the following document.
https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-pinning.html
- Import your own certificate into ACM and then pin your application to the imported certificate. ACM doesn't provide managed renewal for imported certificates.
- If you're using a public certificate, pin your application to all available Amazon root certificates. If you're using a private certificate, pin your application to the CA's root certificate.
If you wanted to use free certificate and rotate auto then you can use letsEncrypt. Let me know if you wanted to know the procedure.
answered a year ago
Relevant content
asked 3 years ago
asked a year ago
When you say Import your own certificate in ACM . Does this mean my domain certificate to ACM ? I am not sure what you mean by public certificate. My application is exposed publicly with an AWS ACM certificate
This means importing a certificate obtained outside of AWS. For example, you might import and use a certificate issued by a third-party certificate authority (CA).