Certificate pinning is a technique where an application stores, or "pins", the expected certificate or public key of a server and refuses TLS connections that present anything else, even if a trusted certificate authority issued it.
Why it matters
Normal validation trusts any certificate signed by any trusted authority. If one authority is compromised or issues a certificate wrongly, an attacker could impersonate a site. Pinning narrows trust to what the app expects, which protects sensitive mobile or desktop clients. Browsers deprecated the HTTP header version (HPKP) because mistakes could lock sites out, and rely on Certificate Transparency instead.
Example
A banking app ships with the hash of its server's public key plus a backup key. When it connects, it compares the hash of the presented key to its list. A corporate inspection proxy using its own certificate would fail the check, so the app shows an error.
Common mistakes
- Pinning a leaf certificate with no backup, then losing connectivity when it renews.
- Having no update path for pins in already installed apps.
- Pinning in a way that breaks legitimate debugging and testing.
- Treating pinning as a substitute for proper TLS setup.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.