Home / Knowledge hub / Certificate pinning
Knowledge hub
Certificate pinning
An app accepting only one expected certificate, so a fake one is refused.
What it means
Certificate pinning means an app is built to trust only a specific certificate, or public key, for its own server, rather than any certificate a trusted authority has issued. If something presents a different certificate, even a valid-looking one, the connection is refused.
Normally a device trusts a long list of certificate authorities. If one of them is tricked, or the user installs a rogue one, a fake certificate for your domain can pass. Pinning narrows that trust to what you expect. Pinning removes that wider trust for your own app.
Why it matters
It protects against someone sitting between the app and your server on a hostile network or on a device with a rogue certificate installed. For apps handling money or health data, it raises the bar for reading traffic. It matters most on shared Wi-Fi.
It is a defence in depth, not a replacement for good server checks. Someone who controls their own device can often get around pinning, and anyone can call your API without your app at all. Your server must still decide authorization on every request.
How it shows up
Mobile apps can pin the certificate, the public key, or the issuing certificate, usually through the platform's network settings or a library. Android's network security configuration supports pins with an expiry date. Pinning to the public key and including a backup pin is safer than pinning one leaf certificate.
The classic failure is operational. A certificate is renewed, the app still expects the old one, and every installed copy stops working until users update. Plan rotation and backup pins first. Testers often bypass pinning on their own test device to inspect traffic, and that is normal in a mobile pentest.
Questions people ask
Certificate pinning, answered
Is certificate pinning the same as HTTPS?
No. HTTPS encrypts traffic and checks the server's certificate against trusted authorities. Pinning adds a stricter check against one expected certificate or key.
You need HTTPS first. Pinning is the extra step.
Can pinning be bypassed?
Yes, by someone who controls the device, using tools that alter the app at run time. Pinning stops casual interception, not a determined person with the phone.
Never place secrets or trust in the client.
Should websites use pinning?
The browser feature for it, HTTP Public Key Pinning, has been deprecated and removed. Browsers now rely on other protections such as certificate transparency.
Pinning is mainly an app technique today.
What happens when the certificate is renewed?
If you pinned the old certificate and nothing else, the app fails to connect. Pin the public key, keep the same key across renewals, or ship a backup pin.
Test rotation before it happens.
Does pinning protect the API from abuse?
No. It protects the connection between your app and server. Attackers can call the API directly with their own tools.
Rate limits and access checks still do that work. Pinning cannot replace them.
Related
Terms that sit next to this one
TLS
The protocol that encrypts traffic between a browser and a server.
Man-in-the-middle attack
Someone sitting between two parties, reading or changing what passes between them.
OWASP MASVS
A standard listing what a secure mobile app should do.
Mobile penetration testing
Testing a mobile app and the services it talks to for security flaws.
Encryption in transit
Protecting data while it travels between a browser and your servers.
Does the server check every call?
Pinning protects the wire, not the logic. We test the API behind your app for broken access checks and business-logic flaws, and prove each with the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.