Archivetls
Certificate Pinning Is a Trade-Off, Not a Free Win
Pinning stops MITM proxies and breaks your app when you forget to rotate the pin.
- Published
- Reading time
- 1 min read
Pinning hard-codes which certificate or public key an app will accept, defeating an attacker who has a valid certificate from a trusted CA. It also defeats corporate proxies, debugging tools, and your own key rotation if done carelessly.
Pin the key, not the cert
Pin the SubjectPublicKeyInfo hash, not the leaf certificate. Then renewals with the same key keep working, and you can ship a backup pin before rotation.
sha256/AAAA... (current)
sha256/BBBB... (backup)
Ship at least one backup pin; a single pin plus an emergency rotation is an outage.
Where it belongs
- Mobile apps with controlled release cycles.
- Device firmware that talks to one backend.
- Internal service meshes, where the identity is already managed.
Where it does not
Browsers, public websites, and anything users may need to debug through a proxy.
Takeaway: pinning trades operational flexibility for reduced CA trust. Use key pins plus a backup, and only where you control the update channel.