MobSecurityCertPinConfig in Mobile Security

Architectural Overview#

The MobSecurityCertPinConfig metadata type configures SSL/TLS certificate pinning for Salesforce Mobile and Mobile Publisher applications under Enhanced Mobile Security. Under standard TLS negotiation, a mobile client trusts any certificate signed by a root Certificate Authority (CA) installed in the operating system’s trust store. However, in hostile network environments (such as untrusted public Wi-Fi or compromised cellular networks), rogue CAs or fraudulent certificates could facilitate Man-in-the-Middle (MitM) eavesdropping.

Certificate pinning eliminates this attack vector. By using MobSecurityCertPinConfig, security architects hard-pin the cryptographic public key hash of trusted Salesforce authentication servers and custom API endpoints directly into the mobile client’s runtime security policy. The mobile app strictly terminates connection attempts if the server’s certificate hash fails to match the pinned configuration.

Directory and File Conventions#

MobSecurityCertPinConfig components are stored within their dedicated folder in the Salesforce DX project source structure.

Key Metadata Fields#

The MobSecurityCertPinConfig schema establishes the cryptographic parameters and domain boundaries for pinning:

Declarative XML and Package Manifest Examples#

The following example configures a certificate pin rule for a corporate My Domain login endpoint:

<?xml version="1.0" encoding="UTF-8"?>
<MobSecurityCertPinConfig xmlns="http://soap.sforce.com/2006/04/metadata">
    <domainName>acmecorp.my.salesforce.com</domainName>
    <certificateHash>sha256/WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=</certificateHash>
    <isEnabled>true</isEnabled>
    <isSubdomainIncluded>false</isSubdomainIncluded>
    <mobilePlatform>Both</mobilePlatform>
    <severityLevel>Critical</severityLevel>
</MobSecurityCertPinConfig>

Package Manifest (package.xml)#

Include MobSecurityCertPinConfig in the deployment manifest:

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>*</members>
        <name>MobSecurityCertPinConfig</name>
    </types>
    <version>68.0</version>
</Package>

CLI Retrieval and Deployment Commands#

Manage certificate pinning metadata with the Salesforce CLI:

# Retrieve all Certificate Pinning configurations
sf project retrieve start --metadata MobSecurityCertPinConfig

# Deploy a specific pinning configuration
sf project deploy start --metadata MobSecurityCertPinConfig:MyDomain_Login_Pin

# Query pinning configurations via Tooling API
sf data query --use-tooling-api --query "SELECT Id, DeveloperName, DomainName, IsEnabled, SeverityLevel FROM MobSecurityCertPinConfig"

Architect Best Practices and Gotchas#

• Certificate Rotation Operations: Establish a coordinated rotation protocol. Deploy the new certificate pin configuration to your Salesforce org well in advance of updating the public TLS certificates on your origin reverse proxy or identity provider.
• Enhanced Mobile App Security Dependency: Deploying MobSecurityCertPinConfig requires an active Enhanced Mobile App Security license in the target org.
• Test with Warn Severity First: When rolling out new certificate pins in staging environments, set severityLevel to Warn to verify that client mobile traffic connects cleanly before switching to Critical enforcement.

Frequently asked questions

What security risk does MobSecurityCertPinConfig mitigate?

It mitigates man-in-the-middle network attacks by ensuring the mobile app communicates only with servers presenting specifically pinned cryptographic certificates.

Where are MobSecurityCertPinConfig files stored in SFDX?

They are located in force-app/main/default/mobSecurityCertPinConfigs/ with the .mobSecurityCertPinConfig-meta.xml suffix.

What core properties define a certificate pinning rule?

Key properties include domainName, certificateHash, isEnabled, isSubdomainIncluded, mobilePlatform, and severityLevel.

Can certificate pinning rules be retrieved using wildcards?

Yes, MobSecurityCertPinConfig supports the asterisk wildcard in package.xml manifests to retrieve all pinning rules.