SSL Pinning & AWS Certificate Manager

SSL Pinning & AWS Certificate Manager

SSL Pinning & AWS Certificate Manager. Just Another Tradeoff Between Security & Stability? Based on the research done in 2014, 33% of CAs/Sub-CAs never issued a public SSL certificate.

IntroductionOne of the key aspects of securing data is protecting data in transit i.e the data that flows to/from mobile applications and backend must be sufficiently protected in order to prevent an adversary to perform Man In The Middle attacks.Isn’t Securely Implemented TLS Enough?

When correctly implemented(for example, only allowing secure cipher suites, latest protocol version, no overriding of default behaviour to disable checks during the handshake, etc.) TLS appears to be sufficient to ensure the confidentiality and integrity of the sensitive data in transit, blocking replay attacks and providing authentication between the two parties. However, in TLS the authenticity of the server is decided based on the server’s SSL/TLS certificate which is issued by a Certifying Authority(CA).Hence the overall security provided majorly works on the basis of a TRUST MODEL wherein the CAs have to be trusted. And since it is fundamentally backed on a trust basis there have been cases of breach of trust/security compromise which sometimes not let stakeholders confident with only TLS in place for protecting data in transit:

There is indeed a need for an additional layer of security to protect our users in case there is a breach of trust/compromise of a trusted CA to prevent an adversary to obtain rouge certificates for our domains and perform Man In The Middle attacks. This is why the mobile security folks recommend SSL Pinning.

aws ssl aws certificate manager

What is Geek Coin

What is GeekCash, Geek Token

Best Visual Studio Code Themes of 2021

Bootstrap 5 Tutorial - Bootstrap 5 Crash Course for Beginners

Nest.JS Tutorial for Beginners

Hello Vue 3: A First Look at Vue 3 and the Composition API

AWS Certification Cost - Types of AWS Certification Exams

AWS Certification Cost and the Types of AWS Certification Exams. In this blog on AWS Certification Cost and types of AWS certification exams, you will learn about different types of certifications in the market.

AWS Training Online Course - Best AWS Certification - Intellipaat

Enroll for best AWS training course with AWS Certification online and placement support. Learn Amazon web services AWS course from certified AWS experts. Enroll Now!

Managed Entitlements in AWS License Manager

AWS License Manager is a service that helps you easily manage software licenses from vendors such as Microsoft, SAP, Oracle, and IBM across your Amazon Web Services (AWS) and on-premises environments. Learn Managed Entitlements in AWS License Manager.

How To Unite AWS KMS with Serverless Application Model (SAM)

AWS KMS is a Key Management Service that let you create Cryptographic keys that you can use to encrypt and decrypt data and also other keys. You can read more about it here.

AWS Tutorial | AWS Certification | AWS Course | Intellipaat

🔵 Intellipaat AWS training:🔵 In this live session on AWS Tutorial video, you will learn AWS fr...