let’s make network communication + SSL public key pinning understandable for a mobile developer in a way that connects with what you already know from iOS/Android dev.
Think of Client–Server Communication Like an App Login Screen
You know how your app’s login screen talks to your backend API?
That’s essentially network communication — but under the hood, there’s a lot going on.
Step-by-Step: What Happens Without Pinning
- App makes request
GET https://api.myapp.com/user/profile - Server sends certificate (like an ID card for the server).
- Device checks: “Is this certificate signed by someone I trust?” (the CA list stored on your phone/OS). Remember CA means Certificate Authority here.
- If trusted → Secure channel created → Data flows encrypted both ways.
The problem
If someone adds their own fake Certificate Authority (CA) to the device (for example, via Wi-Fi hacking tools, malicious configuration profiles, or debugging tools like Charles Proxy), your app might still trust it because the operating system will treat that CA as trusted.
Step-by-Step: What Happens With Public Key Pinning
You (the developer) say:
“I don’t care if the OS says the cert is fine. I want to check the server’s actual public key and only talk to it if it matches the one I know.”
Here’s how it works behind the scenes:
- App makes request →
GET https://api.myapp.com/user/profile - Server sends certificate (contains a public key inside).
- Your app extracts the public key from the certificate.
- Your app compares it with the pinned key stored in your code/bundle.
- If match → Continue TLS handshake, data is encrypted, and request goes through.
If mismatch → Cancel request → Prevent possible MITM attack.
Mobile Dev Analogy
Think of it like:
- Normal HTTPS: “I’ll trust anyone the OS says is safe.”
- Public Key Pinning: “I will only trust the real backend I know, even if the OS says someone else is safe.”
When This Matters for Mobile Apps
- Banking, payment, healthcare apps (high security)
- Apps where sensitive data (tokens) travels over the network
- Apps that can be a target for reverse engineering or MITM attacks
Happy coding!
One thought on “SSL Pinning Explained for Mobile Developers”