Notifications
Clear all
Topic starter
11/07/2026 8:23 pm
TL;DR: Mobile apps now carry banking, personal, and password data at consumer scale, while a StatCounter study cited in the article puts mobile internet use at 51.3% versus 48.7% on desktops, making application trust controls more consequential than ever. Certificate handling, code signing, and transport protection are no longer just app-team concerns because they shape identity trust and data exposure across the mobile stack.
NHIMG editorial — based on content published by GlobalSign: mobile application security certificates and related threats
By the numbers:
- Almost half of developers have taken no measures to secure their applications, and 60% of organisations have reported past data breaches.
Questions worth separating out
Q: How should security teams govern mobile app certificates in practice?
A: Treat mobile app certificates as lifecycle-managed trust assets, not one-time setup items.
Q: Why do mobile apps create identity governance gaps?
A: Mobile apps create governance gaps when access is approved once and then left outside lifecycle processes.
Q: What do security teams get wrong about SSL/TLS in mobile apps?
A: Many teams treat SSL/TLS as a checkbox for encryption and stop there.
Practitioner guidance
- Inventory all app-facing certificates and domains Map every mobile application domain, API endpoint, wildcard certificate, and SAN entry to a named owner, renewal date, and business service so no certificate is managed as an anonymous asset.
- Protect code-signing keys like privileged credentials Store signing keys in hardened controls, restrict who can use them, and monitor each signing event so release integrity cannot be bypassed by an exposed or reused key.
- Align mobile trust controls with identity governance Require security review for any app that handles credentials, payment data, or personal information, and tie certificate policy to release approval and incident response ownership.
What's in the full article
GlobalSign's full article covers the practical detail this post intentionally leaves at a higher level:
- Specific guidance on wildcard and SAN certificate selection for mobile and web application estates
- A plain-language explanation of how SSL/TLS and code signing differ in protecting app trust
- Examples of common mobile attack patterns such as phishing apps, spyware, and drive-by downloads
- The article’s developer-focused recommendations for integrating certificate security into app delivery
👉 Read GlobalSign's analysis of mobile app certificates and security →
Mobile app security certificates: what IAM teams should watch?
Explore further
11/07/2026 8:53 pm
Mobile app trust is now a governance problem, not just a development concern. The article shows that users routinely place high-trust data into mobile apps without a reliable way to judge whether the app, its certificate chain, or its code origin is trustworthy. That creates a verification gap between user confidence and technical assurance. For identity and security programmes, application identity becomes part of the trust model that underpins access, fraud reduction, and data protection.
A question worth separating out:
Q: What should organisations do when mobile apps handle sensitive user data?
A: Require stronger release governance, protect signing keys, and verify that certificate coverage matches the app’s real domain and API footprint. Add review for apps that handle banking or identity data, because those applications deserve the same scrutiny as any high-risk access pathway.
👉 Read our full editorial: Mobile app security certificates are now a governance issue
