On-Prem TrustService for Cert Pinning

[JamieAndersonJa]

Have any on-prem customers successfully setup a TrustService for the upcoming cert pinning requirements. We are on 18.11 and having difficulty getting the trustservice end point up and running. Federal support hasn't been much help resolving the issue.

If you have, how are you able to verify that cert pinning is working in your environment?

[Stansfield]

Have you heard anything about this being required?  I had not heard anything about this for quite awhile but vmware failing to notify people would not surprise me.

[JamieAndersonJa]

Cert Pining itself is supposed to be a requirement next year. The need for an on-prem trust service is optional

[Stansfield]

Do you have a document or link saying that by any chance so I can show that to my group?  for cert pinning being needed next year, we are wary and have not implemented that for Prod yet.  Out of curiosity what led to you using your own trust services instead of the cloud ones?

[JamieAndersonJa]

I don't have a document saying when the cert pinning deadline will be. Everything I know is coming from our TAM so it could change w/o notice but it's the best I have. Subscribe to this article, https://support.workspaceone.com/articles/115005083527. When they do make the announcement, i believe they will update this doc.

Our Security team wants the TrustService in place, that's the best i can tell you. it would be a lot simpler to use the cloud service for sure.

[sturmanc]

SSL Pinning and Outbound SSL Interception Proxies
https://support.workspaceone.com/articles/115009643247

Early 2020, VMware AirWatch will begin enforcing SSL pinning in its mobile applications. Although SSL pinning to Device Services is optional and may be disabled by customers with On-Premises, or Dedicated SaaS environments, certain communications between VMware AirWatch mobile applications and VMware AirWatch cloud services will always be pinned for enhanced security.