Certificate Pinning - Public Key only?
certificate, ios, pinning
Solution
I would argue that it is better to pin the public key of the subject rather than the root's CA public key. Here is my understanding of the different trade-offs of pinning the CA's root pkey:
The good As long as you keep that same CA, you will be able to update your certificate over and over again and it will always work.
The bad I believe that you will be slightly more vulnerable to a MITM attack pinning the roots CA's pkey instead of the subjects public key, since you will take as valid any certificate signed by that CA, instead of just those that really match your subject.
What about pinning the public key of the subject then? Basically you should be slightly more safer than pinning the CA's public key, and you application should continue working even after the certificate expires and you renew it, as long as you maintain the same public key.
I just posted a question and solution on how to pin the public key, I hope it helps you: How to pin the Public key of a certificate on iOS
Problem
I would like to pin the public key of an root CA (verisign - http://www.verisign.com/repository/roots/root-certificates/PCA-3G5.pem) into my iOS app. Is is better to pin the public key or the subjectPublicKeyInfo? Could someone please explain me which method is better and why?