title: How safe are client SSL certificates in a mobile app?
body: <p>I'd like to have secure communication between my Android/iOS app and my Internet-accessible backend service, so I'm investigating HTTPS/SSL.</p>
  
  <p>If I create self-signed certificates, then put a client certificate in the app and cause the backend service to require <em>that</em> client certificate, <strong>is this truly secure</strong>?</p>
  
  <p>Here's why I'm asking. It seems that the client certificate could be "hacked" by interrogating the .apk. The client certificate is just a string constant, right? That means anyone could use the client certificate to access my backend. <strong>Is the .apk (and iOS equivalent) sufficiently opaque to prevent the client certificate from being discovered</strong>?</p>