Dynamic SSL Pinning
for Kubernetes

Add Helm repository

helm repo add ssl-pinning https://ssl-pinning.github.io/charts
helm repo update

Generate RSA signing keys

The server signs the pin registry with a 4096-bit RSA private key. The public key is embedded in the Android APK for signature verification.

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out prv.pem
openssl rsa -pubout -in prv.pem -out pub.pem

Create values.yaml

apps-secrets:
  ssl-pinning-tls:
    data:
      prv.pem: <base64 -i prv.pem | tr -d '\n'>

apps-configmaps:
  ssl-pinning-config:
    data:
      config.yaml: |
        keys:
          - fqdn: api.example.com
            domainName: "api.example.com"
        server:
          listen: 0.0.0.0:7500

apps-stateless:
  ssl-pinning:
    replicas: 1
    containers:
      app:
        image:
          name: ghcr.io/ssl-pinning/ssl-pinning
          staticTag: v1.1.0
        ports: |
          - name: http
            containerPort: 7500
        env:
          SSL_PINNING_SERVER_LISTEN: 0.0.0.0:7500
          SSL_PINNING_STORAGE_TYPE: redis
          SSL_PINNING_STORAGE_DSN: redis://valkey:6379/0
          SSL_PINNING_TLS_DIR: /opt/ssl-pinning/tls
          SSL_PINNING_TLS_DUMP_INTERVAL: 1s
        volumeMounts: |
          - name: tls
            mountPath: /opt/ssl-pinning/tls
            readOnly: true
          - name: config
            mountPath: /etc/ssl-pinning
            readOnly: true
    volumes: |
      - name: tls
        secret:
          secretName: ssl-pinning-tls
      - name: config
        configMap:
          name: ssl-pinning-config
    service:
      enabled: true

apps-ingresses:
  ssl-pinning:
    class: nginx
    rules: |
      - host: ssl-pinning.example.com
        http:
          paths:
            - path: /
              pathType: Prefix
              backend:
                service:
                  name: ssl-pinning
                  port:
                    number: 7500

Install

helm install ssl-pinning ssl-pinning/ssl-pinning \
  --namespace ssl-pinning \
  --create-namespace \
  -f values.yaml

Get public key for the Android / iOS SDK

Pass the base64-encoded public key as signingKeyBase64 in SslPinningConfig.

base64 -i pub.pem | tr -d '\n'