Skip to content

Commit

Permalink
Updates per issue 1165. Fixed lint errors
Browse files Browse the repository at this point in the history
  • Loading branch information
markgamache committed Jul 1, 2024
1 parent 7839d52 commit 87c8e9a
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions cheatsheets/Pinning_Cheat_Sheet.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ Keep in mind that this when is about at what point in time you pin. The first qu

### When Do You Perform Pinning

There is almost no situation where you should consider pinning. The risk of outages almost always outweighs any security risks given advances in security. If you consider pinning, you should read [Certificate and Public Key Pinning](https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning) and fully understand the threat model.
There is almost no situation where you should consider pinning. The risk of outages almost always outweighs any security risks given advances in security. If you consider pinning, you should read [Certificate and Public Key Pinning](https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning) and fully understand the threat model.

### When Do You Not Pin?

Expand All @@ -52,11 +52,11 @@ In order to decide what should be pinned you can follow the following steps.

1. Decide if you want to pin the root CA, intermediate CA or leaf certificate:

- Pinning the **root CA** is generally not recommended since it highly increases the risk because it implies also trusting all its intermediate CAs.
- Pinning a specific **issuing or intermediate CA** reduces the risk but the application will be also trusting any other certificates issued by that CA or sub-CAs, not only the ones meant for your application.
- Pinning a **leaf certificate** is recommended but must include backup (e.g. intermediate CA or a pinset containing alternates). This provides 100% certainty that the app exclusively trusts the remote hosts it was designed to connect to while adding resiliency for failover or certificate rotation.
- Pinning the **root CA** is generally not recommended since it highly increases the risk because it implies also trusting all its intermediate CAs.
- Pinning a specific **issuing or intermediate CA** reduces the risk but the application will be also trusting any other certificates issued by that CA or sub-CAs, not only the ones meant for your application.
- Pinning a **leaf certificate** is recommended but must include backup (e.g. intermediate CA or a pinset containing alternates). This provides 100% certainty that the app exclusively trusts the remote hosts it was designed to connect to while adding resiliency for failover or certificate rotation.

For example, the application pins the remote endpoint leaf certificate but includes a backup pin for the intermediate CA. This increases the risk by trusting more certificate authorities but decreases the chances of bricking your app. If there's any issue with the leaf certificate, the app can always fall back to the intermediate CA until you release an app update.
For example, the application pins the remote endpoint leaf certificate but includes a backup pin for the intermediate CA. This increases the risk by trusting more certificate authorities but decreases the chances of bricking your app. If there's any issue with the leaf certificate, the app can always fall back to the intermediate CA until you release an app update.

2. Choose if you want to pin the **whole certificate** or just its **public key**.

Expand Down

0 comments on commit 87c8e9a

Please sign in to comment.