Certificate Pinning In Xamarin.Forms

Securing communications between applications and services is extremely important, and mobile apps are no exception. Even if you use an encrypted channel based on HTTPS, you should never completely trust the identity of the target. For example, an attacker could easily discover the URL your application is pointing to, and put a fake certificate in the middle of the communication between an application and the server, thus intercepting the communication. This is extremely dangerous especially if the application handles sensitive data. In order to avoid this, a technique called certificate pinning can be used to dramatically reduce the risk of this kind of man-in-the-middle attack. This article describes how to implement certificate pinning in Xamarin.Forms, making your mobile apps more secure.

When Do You Need Certificate Pinning?

Generally speaking, you should implement certificate pinning every time you build apps that handle sensitive data and that call HTTPS URLs. Additionally, many enterprises make strict security checks before validating and distributing an app, even if for internal use only, including penetration tests. Penetration tests search for security holes in an application, and simulating a man-in-the-middle attack with a fake certificate is a common test scenario. By implementing certificate pinning, you avoid the risk of certificate replacement and this penetration test will pass.

What Do You Need To Implement Certificate Pinning?

In order to implement certificate pinning, you will need the valid certificate’s public key. This can be provided by your system administrator. For demonstration or development purposes, you can also create a self-signed certificate and retrieve the public key on your own. I won’t cover this scenario here, since the documentation from Microsoft has an excellent coverage here.

How It Works

In Xamarin.Forms, you typically use the System.Net.Http.HttpClient class to send requests over the network, using methods such as GetAsync, PostAsync, PutAsync, and DeleteAsync. Under the hoods, HttpClient relies on the System.Net.HttpWebRequest class. The behavior of the latter can be influenced working with the System.Net.ServicePointManager class, which can be instructed to check what kind of security protocol is being used and to validate the certificate at every Web request. For a better understanding, create a new Xamarin.Forms project in Visual Studio 2017. The attached sample solution is based on .NET Standard as the code sharing strategy. When ready, add the following class,

In this class, you can store both the valid and fake public keys. In the real world, you might want to encrypt the real public key or you might consider other options to store it. The next step is setting up the ServicePointManager class. In App.xaml.cs, add the following method (which requires a using System.Net directive):

This code assigns the ServicePointManager.SecurityProtocol with the type of protocol you want to check, while ServerCertificateValidationCallback represents the action that must be executed to check if the certificate is valid. The following code demonstrates this: