Forum Discussion

msamir_312520's avatar
msamir_312520
Icon for Nimbostratus rankNimbostratus
Mar 06, 2017

SSL pinning

We are in development stage for mobile app and we successfully integrate Frond end application server with F5 ASM . We have new change request in order to secure mobile application with SSL certific...
ASM Advanced WAF
security
Simon_Waters_13's avatar
Simon_Waters_13
Icon for Cirrostratus rankCirrostratus
Mar 07, 2017

No, the F5 probably can't make your Android app pin.

 

You can use HPKP to pin certificates in browsers, but it is unlikely that mobile apps will honour these settings, since it requires client side state to be preserved between visits.

 

There should be no MITM with TLS unless the user or the device has added a trusted CA. But if you want to pin and many mobile apps do, you'll what to change the app.