Certificate Pinning Bypass
Overview
Certificate pinning enhances TLS by restricting which certificates are trusted for specific connections. Bypassing or disabling pinning allows MITM attacks even on apps that previously validated certificates.
Common bypass methods:
- Setting
checkValidity = falsein pinning configuration - Using a catch-all TrustManager
- OkHttp pinning disabled
- Node.js
NODE_TLS_REJECT_UNAUTHORIZED=0
Remediation
- Implement pinning using the native OS keystore or a dedicated library
- Monitor for pinning bypass attempts
- Test pinning resistance against tools like Frida, Objection