TLS/SSL pinning

TLS/SSL pinning is a security mechanism that

  • validates server certificates against a predetermined set of trusted certificates or keys

  • prevents man-in-the-middle attacks by rejecting connections to servers with unexpected certificates, and

  • requires applications to maintain a local store of trusted certificate information for validation.

TLS/SSL pinning implementation details

Some applications use a technique referred to as TLS/SSL pinning or certificate pinning, which embeds the fingerprint of the original server certificate in the application itself. As a result, if you configured a decryption rule with a Decrypt - Resign action, when the application receives a resigned certificate from a managed device, validation fails and the connection is aborted.

To confirm that TLS/SSL pinning is occurring, attempt to log in to a mobile application like Facebook. If a network connection error is displayed, log in using a web browser. (For example, you cannot log in to a Facebook mobile application but can log in to Facebook using Safari or Chrome.) You can use Firepower Management Center connection events as further proof of TLS/SSL pinning

Note

TLS/SSL pinning is not limited to mobile applications.

If applications in your network use SSL pinning, see TLS/SSL certificate pinning guidelines.