A municipal web app uses certificate pinning that breaks the tester’s TLS interception. What is the sound methodological response?
Select an answer to reveal the explanation.
Short Explanation
Pinning slamming the door on your proxy is a known roadblock, not a license to nuke PKI. Good testers note the limit, pick alternate in-scope methods, and stay inside the RoE. Breaking the city’s trust fabric to “win” interception is the wrong kind of creativity.
Full Explanation
When certificate pinning breaks TLS interception, the sound response is to recognize interception limits and adjust the approach within the rules of engagement rather than forcing unsafe workarounds outside scope. Municipal apps may pin for good reasons; testers should document the limitation, use alternative authorized techniques (instrumented builds, test builds, API-direct testing if allowed), and avoid collateral damage to city PKI.
Disabling the city’s entire PKI until pinning is removed is unacceptable. Switching to cleartext injection on production switches is unsafe and likely unauthorized. Declaring the app untestable and ending without documenting the limitation fails professional reporting.
Exam caveat: methodology maturity includes adapting to TLS constraints while preserving RoE. CPTS writeups should record what could and could not be intercepted.
Operational check: notify the civic technical contact, document pinning as a test constraint, agree on an alternate in-scope method if available, and continue testing reachable surfaces without breaking enterprise trust infrastructure. Write the pinning limitation clearly in the municipal findings so sponsors understand coverage gaps without interpreting them as tester failure.