Protocols & PKIAcceptable
Certificate and public key pinning
Restricting which certificates or keys an application accepts
How it works
Pinning means an application only accepts a specific certificate or public key (or a hash of it) for a host, instead of any certificate that chains to a trusted CA. It defends against mis-issued certificates and interception proxies. HTTP Public Key Pinning (HPKP, RFC 7469) offered this to websites but was removed by major browsers because mistakes could lock users out.
Status: Useful in mobile apps with a backup-pin plan; browser HTTP pinning (HPKP) is deprecated.
Strengths
- Blocks man-in-the-middle attacks using rogue or mis-issued CA certificates
- Common hardening control in mobile banking and high-value apps
Weaknesses and known attacks
- Key rotation or CA changes can break the app if backup pins are not included.
- Attackers with control of the device can bypass pinning (for example with instrumentation tools), so it is not a complete defence.
Use it for
- Mobile and desktop clients talking to your own APIs
Don't use it for
- Websites via HPKP
- Pinning a leaf certificate without a rotation plan
Exam tip
Pinning defends against a compromised or rogue CA. For browsers, Certificate Transparency logging is now the main control against mis-issued certificates.