Connection Settings

Overview

Connection Settings help Team and Enterprise tenants review and configure network trust controls for protected apps. Use this area to manage certificate pinning, trusted certificate behavior, TLS policy, cleartext prevention, and certificate transparency enforcement.

Some settings enforce network policy directly. Others detect risky conditions and let you choose a response action. Roll out network changes carefully because strict transport policy can affect login, API calls, third-party SDKs, and regional infrastructure.

Access Connection Settings

1. Log in to the AppTego Portal.
2. Select the correct tenant.
3. Choose the intended environment.
4. Open Connection Settings in the sidebar.

Certificate Pinning

Certificate pinning restricts which certificates or certificate authorities your protected app should trust for selected domains. Use it when your app handles sensitive traffic and your backend certificate lifecycle is well understood.

Certificate pinning is an Enterprise response control for Android and iOS. Configure its response action carefully, because strict enforcement can interrupt app traffic if pins, domains, or certificate rotation are wrong.

Add A Certificate

1. Select the certificate management area.
2. Add a CA certificate or individual certificate.
3. Enter the domains the certificate applies to.
4. Review the thumbprint, hash algorithm, source, expiry, and CA/leaf status.
5. Add a backup or rotation path before using strict enforcement in Production.

Trusted Root CAs

The Trusted Root Certificate Authorities setting controls whether trusted root CAs are accepted by the protected app. Review this setting with your backend and security teams before tightening trust policy.

Certificate Expiry Warnings

The portal displays visual indicators when pinned certificates are approaching expiration. Plan rotation in advance: add replacement material, validate a protected build, and release before the old certificate expires.

Dual Pinning Modes

• Leaf certificate pinning pins a specific server certificate and requires careful renewal planning.
• CA certificate pinning pins an issuing certificate authority and can be easier to operate across normal certificate renewals.

For detailed certificate pinning configuration, see Certificate Pinning.

Connection Controls

Strict connection controls are Enterprise controls in the catalog:

Proxy and VPN detections are configured with the other Detection & Response controls, not as strict connection controls on this page.

Response Actions

When a network threat is detected, you can choose how the app responds:

Best Practices

1. Start response controls in Log mode so you can understand real user behavior before enforcement.
2. Plan certificate rotation before enabling strict pinning in Production.
3. Keep backup pins or a documented recovery path for certificate changes.
4. Validate login, API calls, third-party SDKs, and regional endpoints after network changes.
5. Use Staging for release-candidate validation before promoting connection policy to Production.