Certificate Pinned Applications

TLS certificate pinning is when a desktop or mobile application validates if the proposed server certificates match the hardcoded ones in the application. It’s a security technique used to prevent man-in-the-middle attacks (MITM) and secure access to your organization’s applications.

Predefined certificate pinned applications bypass the Netskope cloud by default. You can also create custom certificate pinned apps and add them as exceptions for your steering configuration to bypass them.

On the Certificate Pinned Apps page (Settings > Security Cloud Platform > App Definition > Certificate Pinned Apps), you can:

Steering and Decrypting Certificate Pinned Applications

You can decrypt traffic of some certificate pinned applications to apply Real-time Protection policies on it. In order to do so, you must first add the application in your steering profile.

After you add the application, perform the following:

1. Go to Settings > Security Cloud Platform > App Definition > Certificate Pinned Apps.

2. Search for the certificate pinned application that you want to steer and decrypt the traffic.

3. Click the ellipsis (…) for the selected application.

4. Click Steering Config Exceptions.

   

5. In the Actions column, click the dropdown menu for the steering profile you are configuring.

6. Click More.

   

7. If the traffic can be decrypted, select the Steer and decrypt at Netskope Cloud steering option.

   

   Once you select this option, all traffic corresponding to this application and operating system is steered through Netskope NewEdge Cloud and is automatically decrypted without any additional required configuration. You can then apply Real-time Protection policies on this application.

Steering and Decrypting DevTools

DevTools usually do not use the system’s certificate store, making the Netskope certificate deployed with NSClient ineffective. Such DevTools are either bypassed or require scripted configurations to deploy the Netskope certificate correctly.

A simpler solution is to use Netskope’s advanced decryption technology to decrypt DevTools traffic without custom configuration.

To do this, manually create these DevTools as custom cert-pinned applications. Refer to Creating a Custom Certificate Pinned Application for details.

Netskope supports the following DevTools. Their configurations are outlined below:

DEVTOOL	PROCESS	DOMAIN(S)
Amazon Web Services (AWS) CLI	aws.exe	-
Azure CLI (azcli)	python.exe	-
Google Cloud (gcloud) CLI	python.exe	-
Composer	php.exe	-
Python	python.exe, pythonw.exe	-

After creating the custom cert-pinned app, configure its “steer and decrypt” option. Refer to Steering and decrypting certificate pinned applications for details.

By default, web traffic from the following predefined certificate pinned apps bypass the Netskope cloud and go directly to the destinations: