# \[Mitmproxy\] Android Apps

**URL:** <https://discourse.mitmproxy.org/t/mitmproxy-android-apps/740>\
**Category:** help\
**Created:** [November 29, 2017, 6:24am UTC](https://discourse.mitmproxy.org/t/mitmproxy-android-apps/740 "2017-11-29T06:24:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![CatLearned](https://avatars.discourse-cdn.com/v4/letter/c/e79b87/32.png) [@CatLearned](https://discourse.mitmproxy.org/u/CatLearned)\
**Post date:** [November 29, 2017, 6:24am UTC](https://discourse.mitmproxy.org/t/mitmproxy-android-apps/740/1 "2017-11-29T06:24:01Z")

</div>

I did some research and found out that some apps are able to drop the internet connection when they see certificate substitution. How do they do it? Are they checking the presence of user certificate or just comparing built-in certificate with the server one?

---

<div class="post-metadata">

**Author:** ![djfromlost](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/djfromlost/32/245_2.png) [@djfromlost](https://discourse.mitmproxy.org/u/djfromlost)\
**Post date:** [November 29, 2017, 11:10am UTC](https://discourse.mitmproxy.org/t/mitmproxy-android-apps/740/2 "2017-11-29T11:10:44Z")

</div>

Hello,

You are probably thinking about Certificate Pinning. Those apps compare the “copy” of the server certificate they already have with the one the server is sending when the connection is established.

[https://www.owasp.org/index.php/Certificate\_and\_Public\_Key\_Pinning#Android](https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#Android)

I used quotes around the word copy because certificate pinning can be implemented in several ways: the app can have a copy of the CA’s certificate, a copy of the server’s certificate, just an hash of those certificates, etc. In the OWASP’s example, the app has a copy of the CA’s certificate and, when a connection is established, the certificate sent by the server is validated against a set of trust anchors containing only that copy.