Forum Discussion
SSL/TSL certificate pinning
I've been researching how to do SSL pinning for our UWP/WPF - MSIX app to secure the server communication.
Can somebody help me how MSIX plays into this? I have configured the packaging project with
<Extension Category="windows.certificates">
<Certificates>
<Certificate StoreName="root" Content="trustid-x3-root.cer"/>
<Certificate StoreName="root" Content="isrgrootx1.cer"/>
<TrustFlags ExclusiveTrust="true"/>
</Certificates>
</Extension>From my reading of the documentation this should/could replace the machine trusted certificate store with only the two certificates that I have provided?
This does not seem to work neither for my packaged wpf app, nor for the packaged UWP app.
Any advice? Am I doing it wrong, or is this not something MSIX can help me with?
1 Reply
Hi marvin_r,
Can you provide more details on what's not working, are you still able to connect to servers without those certs or are you getting an error when trying to connect?
Just some quick checks:
- Make sure the public key of the certs you're referencing are available in your package
- Make sure the server you're connecting to has the certs you specify in the trust chain.
Have a look at these docs for more guidance. (the first link also includes using code checks as an option):
- https://docs.microsoft.com/en-us/previous-versions/windows/apps/hh465031%28v%3dwin.10%29
- https://docs.microsoft.com/en-us/previous-versions/windows/apps/hh465019%28v%3dwin.10%29
- https://docs.microsoft.com/en-us/previous-versions/windows/apps/hh465031(v=win.10)
Cheers,
Tanaka
