Certificate Pinning

Certificate Pinning est une technique de sécurité où une application ne fait confiance qu'à un sous-ensemble spécifique de certificats ou clés publiques pour un domaine donné, plutôt qu'à tous les certificats validés par les CAs racines du système. Renforce contre attaques MITM via CAs compromises ou rogue (DigiNotar 2011, Symantec distrust 2017).

Mécanismes :
(1) **Certificate pinning** — pin certificat exact (fingerprint SHA-256). Fragile : tout renewal cert nécessite app update.
(2) **Public key pinning** — pin public key (SubjectPublicKeyInfo SHA-256). Plus robuste : peut renouveler cert avec même key.
(3) **CA pinning** — accept only certificats issued by specific CAs. Flexible mais moins strict.

Where implemented :
(1) **Mobile apps** — most common use case. Bank apps, Facebook, Twitter, Signal, WhatsApp pin certs/keys leur backend.
(2) **IoT devices** — firmware embed expected certs pour cloud backend.
(3) **Desktop apps** — Chrome browser used to pin Google domains (now via Certificate Transparency primarily).
(4) **HPKP** (HTTP Public Key Pinning, RFC 7469) — HTTP header for web — **deprecated 2018** car too risky (broken sites). Replaced by Certificate Transparency monitoring.

Implémentations :
- **iOS** : NSURLSession with custom URLSessionDelegate validating challenge ; or TrustKit library (popular).
- **Android** : OkHttp CertificatePinner, Network Security Config (Android 7+), TrustKit.
- **Web/JS** : impossible browser-side standard (HPKP deprecated) ; can implement via Service Workers limited.

Risks et challenges :
(1) **Brick risk** — wrong pin = app cannot connect ; emergency fixes require app updates (App Store review 1-7 days delay critical).
(2) **Cert rotation** — must coordinate pin updates avec cert renewals ; backup pins recommended (pin 2-3 certs).
(3) **Pentesting friction** — pentesters can't intercept traffic via Burp/proxy unless pinning bypassed (Frida, Objection).
(4) **Pinning bypass techniques** — Frida scripts, SSL Kill Switch, Magisk modules — attackers ou researchers can defeat.

Migration moderne : (1) **Certificate Transparency** + monitoring CT logs ; (2) **Network Security Config Android** declarative ; (3) **Expect-CT header** (deprecated, but enforced CT for window) ; (4) **DANE/TLSA** (DNS-based authentication, niche adoption).

Quand worth complexity : high-value targets (banking, healthcare, government) where MITM risk exceeds operational burden. Compétences Security+, CISSP, SC-300.