# Preventing Man-in-the-Middle Attacks in iOS with SSL Pinning | raywenderlich.com **URL:** \ **Category:** ๐ŸŽ“ Courses & Articles\ **Created:** [May 29, 2019, 1:54pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364 "2019-05-29T13:54:43Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![lorenzoboaro](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/lorenzoboaro/32/99103_2.png) [@lorenzoboaro](https://forums.kodeco.com/u/lorenzoboaro)\ **Post date:** [May 29, 2019, 1:54pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/1 "2019-05-29T13:54:43Z")
In this tutorial, youโ€™ll learn how to prevent man-in-the-middle attacks using SSL Pinning and Alamofire. Youโ€™ll use the Charles Proxy tool to simulate the man-in-the-middle attack. * * * This is a companion discussion topic for the original entry at [https://www.raywenderlich.com/1484288-preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning](https://www.raywenderlich.com/1484288-preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning) ---
**Author:** ![wangguan1](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/wangguan1/32/81494_2.png) [@wangguan1](https://forums.kodeco.com/u/wangguan1)\ **Post date:** [May 29, 2019, 3:54pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/2 "2019-05-29T15:54:13Z")
Nice follow-up after the Charles proxy tutorial, thanks ---
**Author:** ![lolgrep](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/lolgrep/32/106950_2.png) [@lolgrep](https://forums.kodeco.com/u/lolgrep)\ **Post date:** [May 29, 2019, 5:01pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/3 "2019-05-29T17:01:36Z")
Very nicely done ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘ ---
**Author:** ![hmlongvo](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/hmlongvo/32/93952_2.png) [@hmlongvo](https://forums.kodeco.com/u/hmlongvo)\ **Post date:** [May 29, 2019, 5:55pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/4 "2019-05-29T17:55:48Z")
Should note that itโ€™s common to hash any certificates included in the app bundle and reverify the hash in the application code after loading them but before passing them on to your trust setup code. Minor, but itโ€™s another step in the PENTest security chain to ensure that the certificate you think youโ€™re trusting is the one you actually included in the app in the first place, and hasnโ€™t been replaced or otherwise compromised. Similarly, you might encrypt or otherwise encode the raw text of the public key included in the app. Not absolute protection, to be sure, but it does make it harder to simply find and replace. ---
**Author:** ![rupanjansen](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/rupanjansen/32/102075_2.png) [@rupanjansen](https://forums.kodeco.com/u/rupanjansen)\ **Post date:** [June 2, 2019, 9:41pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/5 "2019-06-02T21:41:27Z")
**Showing Recent Messages** SWIFT\_VERSION โ€˜5.0โ€™ is unsupported, supported versions are: 3.0, 4.0, 4.2. (in target โ€˜Alamofire iOSโ€™) ---
**Author:** ![manuelmb](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/manuelmb/32/81494_2.png) [@manuelmb](https://forums.kodeco.com/u/manuelmb)\ **Post date:** [June 5, 2019, 6:40pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/6 "2019-06-05T18:40:38Z")
Thanks for the tutorial, I have a question. In the Structure of a Digital Certificates there is the Valid To field: Not Valid After Wednesday, 14 August 2019 at 14:00:00 Central European Summer Time You need to compulsory update the app with a new Certificate before the Certificate is not longer valid or how do you manage it? ---
**Author:** ![rcritz](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/rcritz/32/111201_2.png) [@rcritz](https://forums.kodeco.com/u/rcritz)\ **Post date:** [June 7, 2019, 10:46pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/7 "2019-06-07T22:46:42Z")
Xcode 10.2 compiles the projects as Swift 5 with no issues. Note this is Alamofire 5 beta thatโ€™s included in the project, not the current Alamofire 4.x release. ---
**Author:** ![jsantanar](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/jsantanar/32/81494_2.png) [@jsantanar](https://forums.kodeco.com/u/jsantanar)\ **Post date:** [September 3, 2019, 11:47pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/8 "2019-09-03T23:47:00Z")
Pretty nice tutorial. I wonder if there is another way to validate you are connecting to the server you are meaning to without having to attach the server certificate (or public key). I am thinking of cases where the servers vary a lot. With the described strategy it would mean that we have to know before hand all those severs and include the certs (or public keys) in the bundle, or keep updating the app with new updated certs in the bundle. And sometimes these approach does not scale. ---
**Author:** ![lorenzoboaro](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/lorenzoboaro/32/99103_2.png) [@lorenzoboaro](https://forums.kodeco.com/u/lorenzoboaro)\ **Post date:** [September 7, 2019, 3:32pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/9 "2019-09-07T15:32:04Z")
You could set up a way to download the new cert from an external service if the one you have is invalid. Otherwise you could make cert pinning configurable, i.e. based on a specific configuration you could enable or disable it. ---
**Author:** ![lorenzoboaro](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/lorenzoboaro/32/99103_2.png) [@lorenzoboaro](https://forums.kodeco.com/u/lorenzoboaro)\ **Post date:** [September 7, 2019, 3:34pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/10 "2019-09-07T15:34:13Z")
This can be for example done with public keys. Through a configuration service you can download (when the app launches, for example) all the keys youโ€™ve configured and validate against those. ---
**Author:** ![manuelmb](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/manuelmb/32/81494_2.png) [@manuelmb](https://forums.kodeco.com/u/manuelmb)\ **Post date:** [September 11, 2019, 6:58pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/11 "2019-09-11T18:58:46Z")
Thank you for your answer. ---
**Author:** ![shogunkaramazov](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/shogunkaramazov/32/108826_2.png) [@shogunkaramazov](https://forums.kodeco.com/u/shogunkaramazov)\ **Post date:** [January 12, 2020, 5:10pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/12 "2020-01-12T17:10:06Z")
This tutorial is more than six months old so questions are no longer supported at the moment for it. Thank you! ---
**Author:** ![shogunkaramazov](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/shogunkaramazov/32/108826_2.png) [@shogunkaramazov](https://forums.kodeco.com/u/shogunkaramazov)\ **Post date:** [January 12, 2020, 5:10pm UTC](https://forums.kodeco.com/t/preventing-man-in-the-middle-attacks-in-ios-with-ssl-pinning-raywenderlich-com/72364/13 "2020-01-12T17:10:11Z")