Free tools Windows power users keep installed
One-click scans. No signup required.
Do not disable TLS certificate checks to make a self-signed certificate work. Configure the app to trust the intended self-signed certificate or private CA, then add certificate or public-key pinning as a separate restriction if your threat model requires it. Android and Apple platforms handle this differently, and platform settings may not cover every networking library your app uses.
Trust and pinning solve different problems
A self-signed certificate is not automatically trusted by a phone’s normal TLS trust store. Trust configuration establishes which certificate or issuer may anchor a valid chain; pinning narrows acceptance to a configured certificate identity or public key. A connection should pass the platform’s certificate validation and any pin check you require. Do not accept every certificate that fails normal validation.
For a service you operate, a private CA can issue server certificates and may be easier to manage than shipping a changing leaf certificate. Whichever approach you choose, limit the trusted anchors and pins to the necessary hosts. OWASP discusses the risks and implementation choices in its mobile app network communication guidance and pinning cheat sheet.
Android: configure a host-scoped trust anchor
For Android networking that honors the platform configuration, use Network Security Configuration instead of a permissive custom TrustManager. The configuration is an XML resource referenced by the application manifest. Android documents this approach for self-signed and privately issued certificates in its Network security configuration guide.
#1 Best Overall
1. Add the certificate resource
Place the intended CA certificate—or the self-signed server certificate when using it directly—in PEM or DER form under app/src/main/res/raw/, for example as my_ca.pem. Do not put a private key in the app. A bundled certificate is public, but the trust it grants should still be narrowly scoped.
2. Create the network security configuration
Create app/src/main/res/xml/network_security_config.xml:
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config>
<domain includeSubdomains="false">api.example.com</domain>
<trust-anchors>
<certificates src="@raw/my_ca" />
</trust-anchors>
</domain-config>
</network-security-config>Replace api.example.com and the resource name with the actual host and certificate you control. This example configures trust; it does not itself pin a key. Avoid a broad base-config unless you specifically intend to change trust for all app traffic.
3. Reference the XML from the manifest
In the application element of AndroidManifest.xml, add:
<application
android:networkSecurityConfig="@xml/network_security_config"
... >Keep the existing application attributes in place. Android’s documentation describes the manifest integration, custom anchors, and domain scoping at developer.android.com/privacy-and-security/security-config.
4. Add Android public-key pins only when appropriate
Android’s Network Security Configuration pin-set uses SHA-256 hashes of certificate SubjectPublicKeyInfo (SPKI), not a raw certificate-file fingerprint. A presented chain must contain at least one configured key. The syntax and pin-generation details are in the Android pinning documentation.
Rank #3
Do not insert a guessed or copied hash: calculate the SPKI hash for the key actually deployed at the intended endpoint, verify it independently, and include a backup key whose private key is controlled and available for a planned rotation. A backup pin that has no deployable corresponding key will not help recovery.
iOS and other Apple platforms: preserve URLSession trust evaluation
URLSession performs server trust evaluation. Apple says that, with App Transport Security (ATS) enabled, custom evaluation can tighten trust for pinning but cannot loosen the required checks. Apple’s Preventing Insecure Network Connections guidance describes extending trust to a self-signed certificate embedded in an app. Its trust configuration documentation covers SecTrustSetAnchorCertificates for setting a bundled certificate as an anchor.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse the actual networking stack’s documented trust APIs. For URLSession, the implementation needs to apply the intended host and trust policy, set only the intended anchor where needed, evaluate the resulting trust, and then enforce any pin restriction. Apple’s SecTrustEvaluateWithError documentation describes trust evaluation. Do not convert an evaluation failure into success or bypass hostname, expiry, or chain checks.
Rank #4
- 2-part carbonless unit set
- Consecutive numbering
- Includes Gift Certificates Available sign
- 25 certificates with envelopes per package
- White/canary form sequence
There is no single delegate example that safely applies to every Apple networking stack. A URLSession delegate does not automatically govern requests made by a third-party HTTP client, a WebView, or another transport. Follow the official documentation for the library and transport that actually sends each request; confirm that it performs the same trust and pin checks.
Choose the certificate and pin lifecycle before release
- Self-signed leaf: the app trusts that specific certificate as an anchor. Replacing it can require an app update unless the rollout has been prepared.
- Private CA: the app trusts the CA anchor, allowing server certificates to be renewed under that issuer. Keep the CA private key protected and limit where its trust applies.
- Public-key pin: the accepted identity follows the key rather than every detail of the leaf certificate. Android’s documented pin is an SPKI SHA-256 hash; do not mistake it for a certificate fingerprint.
- Backup and rotation: plan deployment of the new key and client acceptance of it before removing the old key. Test a rollback path so a server-side change does not strand installed clients.
Android supports an expiration date for a pin-set. Expiration can reduce the risk that an app with stale pins remains disconnected indefinitely, but pinning is disabled after the configured expiration. Treat that as an explicit security-versus-availability decision, not as a substitute for a rotation plan; see the Android pinning guidance.
Check the app build and every network path
Test the release configuration, not only a debuggable build. Android debug-overrides can add debug-only trust anchors, and pinning is not performed for a chain that uses one of those anchors. A successful debug connection therefore does not prove the release app accepts the intended production chain and enforces its pins. Android explains this behavior in its debug-overrides documentation.
Recommended Free Tools
Also verify which components use the platform configuration. Android framework-managed traffic can use Network Security Configuration, but third-party libraries may have their own TLS settings. Confirm behavior for each HTTP client, WebView, and other transport rather than assuming one setting covers them all. OWASP cautions that custom pin validation can introduce serious vulnerabilities; see its Pinning Cheat Sheet.
Android trust defaults depend on target SDK: the documented default anchors for apps targeting API 23 or lower include user-added CAs, unlike newer target behavior. Android 17/API 37 also documents a localhost-specific implicit configuration when no configuration is defined, with no pin enforcement by default. Check the current platform documentation and your app’s target SDK before drawing conclusions about those cases; do not treat localhost behavior as evidence of production pinning.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting failed connections
- Android reports an untrusted certificate: check that the certificate resource is in
res/raw, the XML points to its correct resource name, the manifest references the XML, and the configured domain matches the request host. - The certificate is trusted but the pin check fails: confirm the hash is SHA-256 of the deployed key’s SPKI, not a certificate fingerprint, and that at least one key in the served chain matches an active pin.
- Debug works but release fails: inspect debug-only trust overrides and verify the release manifest, XML resource, endpoint certificate chain, and release build settings independently.
- URLSession succeeds but another request path fails—or the reverse: identify the networking library actually issuing that request and check its own trust configuration. Platform-managed settings are not proof that another transport uses the same policy.
- Connections break after certificate or key rotation: compare the new chain’s keys with the app’s active pins and check whether clients have a valid backup pin. Restore a previously accepted key or issue a compatible app update through the recovery plan.
- A test succeeds with an unexpected certificate: check whether a debug anchor or overly broad trust configuration is in effect. Retest with the release build and a deliberately wrong certificate or key; the connection must fail.
Or skip the browser setup
ScreenshotNeo is a separate website screenshot API; it does not configure certificate pinning for a native app. If your project also needs website captures, one GET request can return an image or PDF. The service removes known cookie/consent banners, newsletter popups, and chat widgets before capture; bot checks, blank pages, and failed loads are not billed. Its MCP server provides screenshot tools for AI agents. The free plan includes 1,000 shots per month without a card, and paid plans start at $5 for 3,000 shots.
Example request (replace the target URL as needed):
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. For a separate website-capture task, sign up for 1,000 free screenshots a month with no card.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
