# Certificate Verification, Avoid SSL Pinning Vulnerability

DevFeed: [Certificate Verification, Avoid SSL Pinning Vulnerability](<https://devfeed.tech/articles/certificate-verification-avoid-ssl-pinning-vulnerability-19241.md>)

Original publisher: [Read original article](<https://www.codenameone.com/blog/certificate-verification-avoid-pinning-vulnerability/>)

Author: Shai Almog

Published: 2017-01-10T00:00:00Z

Content type: tutorial

Language: en

Sources: [CodeName One](<https://devfeed.tech/sources/codename-one.md>)

Topics: [SSL](<https://devfeed.tech/topics/ssl.md>), [Security](<https://devfeed.tech/topics/security.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [App](<https://devfeed.tech/topics/app.md>), [Code](<https://devfeed.tech/topics/code.md>), [Extension](<https://devfeed.tech/topics/extension.md>)

Tags: [app](<https://devfeed.tech/tags/app.md>), [certificates](<https://devfeed.tech/tags/certificates.md>), [code](<https://devfeed.tech/tags/code.md>), [developers](<https://devfeed.tech/tags/developers.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

The article explains HTTPS certificate verification, the risks of fraudulent certificates and man-in-the-middle attacks, and how certificate pinning can help protect sensitive applications. It also introduces a Codename One library that checks a server certificate fingerprint against authorized keys.

## Source excerpt

Certificate pinning is a security measure designed to thwart potentially dangerous and complex attacks. Since those sort of attacks are pretty hard to execute it's a security measure that is probably unnecessary for most developers. However, if you are building an application for a very sensitive industry (e.g. Government, Banking etc.) you might be required to include this defensive measure. When we connect to an HTTPS server our client checks the certificate on the server. If the certificate was issued by a trusted certificate authority then the connection goes thru otherwise it fails. Let's imagine a case where I'm sitting in a coffee shop connected to the local wifi, I try to connect to gmail to check my email. Since I use HTTPS to Google I trust my connection is secure.