What Is Certificate Pinning?
Certificate pinning ties an application to a specific certificate or public key for a server, so it rejects every other certificate — even ones the operating system would normally trust. It closes a gap in ordinary TLS: the fact that any trusted certificate authority can issue a certificate for your domain, so a compromised or coerced CA could enable interception.
What problem does pinning solve?#
Normal TLS trusts a whole set of certificate authorities. If any one of them issues a fraudulent certificate for your server — through compromise, coercion, or error — a man-in-the-middle could present it and pass validation. Pinning narrows trust to your specific certificate or key:
| Standard TLS | With pinning | |
|---|---|---|
| Trusts | Any valid CA | Only the pinned cert/key |
| Fraudulent CA cert | Accepted | Rejected |
| Flexibility | High | Low (by design) |
Because only the pinned identity is accepted, a fraudulent certificate from another CA simply does not match — and the connection is refused.
Why is pinning used carefully?#
Because its strength is also its fragility. If the pinned certificate rotates and the app has not been updated with the new pin, the app locks itself out. This is why the web largely abandoned HTTP Public Key Pinning, while mobile apps — which control both ends and update together — still use pinning with backup pins.
Certificate pinning hardens TLS against CA compromise. More at the Network Security hub.
Frequently asked questions#
What is certificate pinning?
Certificate pinning is a technique where an application is configured to accept only a specific certificate or public key for a server, rejecting any other — even one that is otherwise valid and trusted by the system. It defends against fraudulent certificates issued by a compromised or coerced certificate authority, a gap that normal TLS validation cannot catch.
What is the risk of certificate pinning?
If the pinned certificate or key changes — through routine rotation or an emergency reissue — and the app has not been updated with the new pin, it will refuse to connect, effectively bricking itself. This operational fragility is why pinning must include a backup pin and a careful rotation plan, and why it is used selectively.