KB325076: New feature in MicroStrategy Mobile 10.3 for Android - Certificate Pinning

What is certificate pinning?
Trusted server support strengthens the normal security provided by HTTPS, in particular making it difficult for a malicious server to carry out a man-in-the-middle attack. While HTTPS simply checks to see if a certificate in the certificate chain for the server exists in the trust store on the mobile device, trusted server support compares the public key for the Mobile Server with the same public key bundled into Strategy Mobile on the mobile device.
 
Like any other application contacting a server, when a Strategy Mobile application attempts to connect to a Mobile Server, it first performs the standard HTTPS certificate verification. If HTTPS verification is successful, Strategy Mobile then checks to see whether it should verify that the Mobile Server is a trusted server. It does this by looking in pins folder in SDK to see if there are any certificates in the folder with the name of the Mobile Server. If it finds a certificate, it compares the hash of the public key in that certificate with the hash of the public key in the certificate on the Mobile Server. If the hashes match, the connection is allowed.
 
What are the advantages of certificate pinning?
The Strategy Mobile implementation of trusted server support follows the IETF certificate pinning guidelines. In addition to minimizing the risk of a man-in-the-middle attack, trusted server support has the advantage that it will continue working even if the certificate for the Mobile Server changes—for example, if it expires. There is no need to recompile the Strategy Mobile app since the public key itself has not changed, only the certificate. There is also support for multiple certificates for a single Mobile Server. This allows you to create a backup certificate for a Mobile Server, without deploying it, and bundle that certificate in Strategy Mobile. If your existing certificate is compromised, the backup certificate can be deployed and your app can keep working.
 
How can this be implemented in the Strategy Android mobile setup?
Trusted server support / certificate pinning can be added to Strategy Mobile for Android using SDK. The following steps illustrate how this can be accomplished:

1. Open the StrategyMobile project in Android Studio.
2. Go to app->src->main->assets->pins folder.
3. Under the pins folder, add a separate folder for each Mobile Server that you want the Strategy Mobile application to trust.
   
   The name of the folder (case sensitive)—should be the fully-qualified name of the Mobile Server — for example, myMobileServer1.myDivision.myCompany.com.
4. In each Mobile Server folder, add the .cer or .pem certificates that should be trusted when Strategy Mobile tries to connect to that server.
5. Save your changes.
6. Compile the application and deploy.

 
Important:

• These steps are specific to the Android version of Strategy Mobile.
• Certificate pinning in Android was first introduced to Strategy Mobile 10.3. 
• The names of folders and certificates are case sensitive.

 
The example provided in this document is provided “as-is” and user has read the following customization warning:
​
ADDITIONAL INFORMATION:
The Strategy SDK allows you to customize several Strategy products and extend and integrate the Strategy business intelligence functionality into other applications. However, before changing the way Strategy products look or behave, it is helpful to understand how the application is built. For more information regarding the Strategy products or the process of customizing Strategy products, please refer to Strategy Developer Zone (https://developer.Strategy.com).
To access the Strategy Developer Zone, you must have access to the Strategy Knowledge Base, you must have purchased the Strategy SDK, and you must be current on your Strategy maintenance agreement. If you are a US-based business and believe that you satisfy all three of these conditions but you do not have access to the Strategy Developer Zone, please contact Strategy Technical Support at support@Strategy.com or at (703) 848-8700. If you are an international business, please contact Strategy Technical Support at the appropriate email address or phone number found at https://www.Strategy.com/us/services/support/contact.
CUSTOMIZATION WARNING:
This customization is provided as a convenience to Strategy users and is only directly applicable to the version stated. While this code may apply to other releases directly, Strategy Technical Support makes no guarantees that the code provided will apply to any future or previous builds. In the event of a code change in future builds, Strategy Technical Support makes no guarantee that an updated version of this particular customization will be provided. In the event of a code change in future builds, Strategy may not be able to provide additional code on this matter even though this customization is provided at this time for this specific build. For enhancements to this customization or to incorporate similar functionality into other versions, contact your Account Executive to inquire about Strategy Consulting assistance.