What is certificate pinning?
Certificate pinning means that an app or client is told in advance exactly which certificate or which public key it should accept from the server. Normally, a client trusts any certificate issued by one of the many trusted issuers in the operating system's trust store. Pinning tightens this: only the expected certificate, or a key from a specific Certificate Authority, is accepted, and everything else is rejected, no matter how valid it otherwise appears.
How does certificate pinning work?
When a TLS connection is established, the server presents its certificate, and the client normally validates the chain up to a trusted root. A pinning client adds an extra check: does the certificate, or typically a hash of its public key, match the value built into the app? If not, the connection is terminated. You can pin at several levels: the server certificate itself, its public key or the issuing CA. Key pinning is the most robust, because the certificate can then be renewed without breaking the pin, as long as the same key pair is reused. The foundation is still ordinary encryption and certificate validation; pinning is just an extra filter on top.
When does pinning make sense?
Pinning is strongest when the developer controls both ends of the connection. Typical examples are mobile apps that only talk to the company's own backend, payment and banking apps, and machine-to-machine integrations between known systems. Here pinning protects against a compromised or mis-issuing CA being used for man-in-the-middle attacks, a risk that ENISA, among others, describes in its threat assessments. Conversely, pinning rarely makes sense against services you do not control yourself, because then others decide when certificates and keys change. That is precisely why the browsers' general pinning mechanism, HPKP, was abandoned: the risk of accidentally locking visitors out was greater than the benefit, and Certificate Transparency logs took over the role as the safeguard against mis-issuance.
The pitfall: pinning and certificate renewal
The classic pinning mistake is self-inflicted downtime: the server's certificate is renewed with a new key pair, the app only knows the old pin, and all users lose their connection until a new app version ships. Pinning is therefore inseparable from managing the certificate lifecycle: renewals must be planned, key pairs and pins must be coordinated, and the app should always contain at least one backup pin for a reserve key pair. In a mature PKI, pinning is thus not a one-off decision in the app team, but part of the overall certificate governance. How those pieces fit together in practice is covered in our e-book PKI and HSM in practice.
How MI Support IT can help
We have many years of specialist experience with enterprise PKI and help you design a pinning strategy that protects without creating fragile operations, including backup pins, key rotation and renewal processes. Read more under PKI Management, or contact us for a concrete assessment.