Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →To connect a native app securely to a server with a self-signed certificate, explicitly trust that certificate—or, usually more manageably, a private CA that issued it—and then add certificate or public-key pinning if your threat model calls for that extra restriction. Do not bypass TLS checks with a trust-all callback. Android and Apple platforms configure trust differently, and platform settings may not cover every networking library used by your app.
Trust the certificate first; use pinning as an additional restriction
Trust configuration and pinning solve different problems. Trust configuration tells the platform which certificate authority or certificate can anchor a valid chain. Pinning narrows the accepted identity further, typically to a particular public key. A certificate can be trusted without being pinned; a pin should not be used to excuse failed identity or validity checks.
As an Amazon Associate I earn from qualifying purchases.
For a self-signed server certificate, the certificate itself can be a trust anchor. If you manage multiple servers or expect leaf certificates to change, a private CA can issue them, letting the app trust the CA rather than bundle every leaf certificate. Keep the trust scope limited to the hosts and anchors the app needs. OWASP describes the case of apps connecting to a server with a self-signed or otherwise system-unknown certificate in its mobile network communication guidance.
Pinning adds operational risk: if the server key changes before users update the app, legitimate connections can fail. Decide how to rotate keys and recover before shipping.
#1 Best Overall
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Android: configure a narrow trust scope and a separate pin set
For Android networking stacks that honor Android Network Security Configuration, use a host-scoped configuration rather than a custom permissive TrustManager. Android documents custom trust anchors for self-signed and privately issued certificates in its Network security configuration guide.
1. Add the certificate and configuration resource
Place the certificate you intend to trust in the app’s res/raw directory, for example res/raw/my_ca.pem. Android accepts PEM or DER certificate resources. The following is a template: replace the example host and the pin values with values calculated for your own server keys.
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
<domain-config>
<domain includeSubdomains="false">api.example.com</domain>
<trust-anchors>
<certificates src="@raw/my_ca" />
</trust-anchors>
<pin-set expiration="2028-12-31">
<pin digest="SHA-256">BASE64_CURRENT_SPKI_SHA256</pin>
<pin digest="SHA-256">BASE64_BACKUP_SPKI_SHA256</pin>
</pin-set>
</domain-config>
</network-security-config>The pin values above are deliberately marked as placeholders and are not valid pins. Android pins are SHA-256 hashes of the certificate’s SubjectPublicKeyInfo (SPKI), not fingerprints of the entire certificate file. A server’s presented chain must contain at least one key matching the configured pins. Android’s pin configuration documentation recommends a backup pin; arrange for the server to present a chain compatible with the current or backup key during rotation.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Reference the configuration from the manifest
Set the application attribute so the platform loads the resource:
<application
android:networkSecurityConfig="@xml/network_security_config"
... >
...
</application>Save the XML as res/xml/network_security_config.xml. The android:networkSecurityConfig attribute belongs on the app’s <application> element. Keep the domain list and trust anchors as narrow as possible; do not configure a private certificate as a general-purpose anchor unless that broad scope is intended.
Rank #2
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
3. Plan pin expiration and key rotation
The optional pin-set expiration is an availability-versus-security decision: after the configured date, pinning is no longer enforced. Choose a date deliberately, and have a plan for distributing updated pins before it. A backup pin is useful only if you can actually move the server to the corresponding key and clients can accept it.
For test certificates, Android supports debug-overrides. Those anchors are added for debuggable builds, and pinning is not performed for a chain using a debug-overrides anchor. Therefore, a successful debug connection does not prove that release pins are enforced. See Android’s debug-only trust anchor guidance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →4. Check the Android version and target SDK
Trust defaults vary with target API level: the documented defaults for apps targeting API 23 or lower include user-added certificate authorities, unlike newer target behavior. Android 17/API 37 also has a localhost-specific implicit configuration when an app has not defined one, with no pin enforcement by default. These are version- and target-dependent details, so inspect the applicable Android configuration rather than assuming one default fits every build. Cleartext defaults also vary by target API; they do not make an HTTP endpoint equivalent to a properly validated HTTPS endpoint.
Apple platforms: retain URLSession trust evaluation and add only narrow exceptions
With URLSession, preserve normal server trust evaluation and ATS protections. Apple says URLSession performs server trust evaluation and allows customization, for example to extend trust to a self-signed certificate embedded in the app. Its default evaluation checks certificate integrity, expiration, hostname match, and a chain to a trusted anchor. Custom evaluation may tighten trust for pinning; it must not turn a failed trust result into unconditional success. See Apple’s Preventing Insecure Network Connections.
Apple documents SecTrustSetAnchorCertificates for configuring a bundled self-signed certificate as an anchor. Use that trust API in the context of a deliberate trust evaluation, and then, if required, compare the evaluated certificate or public key with the app’s intended pin. Apple’s references for Configuring a Trust and SecTrustEvaluateWithError describe the relevant APIs.
The exact implementation depends on the networking stack. A URLSession delegate does not automatically cover requests made through a third-party HTTP library, a WebView, or another transport. Confirm the specific library’s official trust-evaluation behavior before relying on platform configuration or delegate callbacks. The available Apple guidance does not establish one universal code sample for all those stacks.
Choose pins and trust configuration to match the app
| Decision | Practical choice | Important consequence |
|---|---|---|
| Self-signed leaf or private CA | Trust the leaf for a tightly controlled single endpoint, or trust a private CA that issues the endpoint certificates. | A CA can ease leaf renewal, but any certificate chaining to that anchor within the configured scope may be trusted; restrict hosts and anchors. |
| Certificate pin or public-key pin | On Android Network Security Configuration, pins are SHA-256 SPKI hashes. | A certificate renewal that reuses a key can preserve a public-key pin; changing the key requires a pin rollout. |
| One pin or backup pin | Configure the current key and a planned backup key where operationally feasible. | Without a usable backup or timely app update, key rotation can strand installed clients. |
| Platform-managed or third-party networking | Use platform configuration where the actual stack honors it; verify library-specific behavior otherwise. | Do not assume a manifest setting or URLSession delegate governs unrelated transports. |
| Debug or release build | Test both, with the release configuration and release-like build flags. | Android debug-overrides anchors can bypass pin enforcement for the chain that uses them. |
OWASP cautions that custom pin validation can introduce serious vulnerabilities if implemented incorrectly. Prefer the platform’s supported configuration and trust APIs where they fit, and review the OWASP Pinning Cheat Sheet when designing custom validation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test both successful trust and deliberate failure
- Install the app’s intended self-signed certificate or private CA anchor and verify that the correct hostname connects over HTTPS.
- Present a certificate for the wrong hostname and confirm the request fails.
- Present an otherwise valid chain with a key that is not pinned and confirm the request fails when pinning is enabled.
- Test the planned key rotation, including the backup key and the app version that will be installed during the transition.
- Run these checks against the release build as well as the debug build; specifically confirm whether debug trust overrides affect the connection.
- Repeat the checks for each networking stack used by the app, including any WebView or third-party client.
Do not treat “the request succeeded” as the only test result. The negative cases establish that the app rejects the wrong identity rather than merely accepting the server certificate because it is self-signed.
Troubleshooting connection and pin failures
- Certificate is still reported as untrusted: Check that the certificate resource is packaged, the XML resource path is correct, the manifest references it, and the requested host matches the configured domain. Then confirm that the networking library honors Android Network Security Configuration or the Apple trust handling you implemented.
- Android reports a pin mismatch: Verify that the configured value is the Base64-encoded SHA-256 SPKI hash for a key in the presented chain, not a whole-certificate fingerprint. Check for a key change and confirm the server chain includes the backup key if that is the intended rotation path.
- Debug works but release fails: Compare the trust anchors and build configuration. Debug-only anchors may make test certificates work in debuggable builds, while release builds correctly reject them; debug-overrides chains also do not exercise Android pinning.
- A renewed certificate breaks clients: Determine whether renewal changed the key as well as the certificate. If the key changed, clients need a compatible backup pin or an app update with the new pin before the server switches.
- Only some requests fail: Identify the component making each request. A separate WebView or third-party transport may not use the configuration or delegate that governs your primary HTTP client.
- Localhost behaves differently: Check Android version, target API, and whether a network security configuration is defined. Android 17/API 37 documents a localhost-specific implicit configuration when none is supplied.
Or skip the browser setup
ScreenshotNeo is a website screenshot API, not a certificate-pinning library; it does not configure TLS trust for a native app. If you separately need a website capture, one GET request returns an image or PDF. For example, this cURL request saves a WebP screenshot of Stripe:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. It removes cookie banners, popups, and chat widgets before the shot; bot checks, blank pages, and failed loads are never billed; an MCP server lets AI agents take screenshots; and 1,000 screenshots a month are free with no card, with paid plans starting at $5 for 3,000. Learn about ScreenshotNeo, or sign up for the free plan.
Frequently Asked Questions
Does trusting a self-signed certificate mean the app is pinning it?
No. Trusting it makes it an accepted trust anchor; pinning is a separate restriction on which certificate or key identity is acceptable.
Will Android Network Security Configuration secure requests from every library in my app?
Not necessarily. Verify the behavior of each HTTP client, WebView, or other networking transport you use; platform configuration may not govern every stack.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
