Giving Android a security boost (Part Two)

Zomato's Android team breaks down SSL certificate pinning: the security feature that could brick your app if done wrong.

Part two of Zomato's security series dives deep into X.509 digital certificates and pinning strategies. The team explains what certificates actually contain and how to choose the right pinning approach without painting yourself into a corner during certificate rotation.

Key Takeaways

• X.509 certificates contain 10 key components: subject, serial number, public key, and more
• Leaf certificate pinning is most secure but requires app updates on rotation
• Public key pinning beats certificate pinning: immune to rotation problems
• Best practice: pin both intermediate and leaf certificates to avoid bricking apps

The article reveals why pinning root certificates creates the largest attack surface and which certificate format extensions actually matter.