SSL pinning - how to safely hide the certificate? We are doing an iPhone app and read multiple forums which says SSL pinning makes it possible to avoid man in the middle as we trust our web services server through the certificate which will be pre bundled along with our app to appstore. 

How can i protect the certificate ? We tried storing inside the app in base 64ed DER format but the string commands on the binary executable prints that data. Is there a way where the certificate is hidden from the attacker so that the IPA file is not vulnerable from giving up the certificate.
You don't need to hide the certificate at all. The certificate only contains the public key and additional info of the owner (in this case the server). It shouldn't contain any private information. What you need to do is to store the certificate in such a way that you can trust the origin of the certificate.

So what you need to think about is certificate management. For instance, what happens if you need to replace the certificate? Is an update of the software enough?

The private key is not part of the certificate. This may not be obvious from certain API's such as the Microsoft API. You must make sure that you only export the X509 certificate(s) excluding the private key. If you are exporting a PKCS#12 (PFX) file then you may be doing something wrong.

The key pair should be generated on the system where you intend to use the private key. Access to the private key should be kept to an absolute minimum. The public key and certificate may be distributed freely.