Certificate Pinning

Overview

Certificate Pinning is a client security technique that restricts a connection to an expected certificate or public key instead of trusting any certificate accepted by the normal trust store. It is used to reduce exposure to compromised or misissued certificate authorities in selected high-risk connections. It differs from standard TLS certificate validation, which relies on the platform trust store and hostname verification.

A typical implementation works as follows: The client stores one or more approved pins, validates the server certificate chain, compares the relevant key or certificate, and rejects unmatched connections. Evidence for Certificate Pinning should record the credential or certificate identifier and decision result without retaining the secret itself.

Common risks include certificate renewal and key rotation. Important failure modes include certificate renewal, key rotation, backup-pin errors, interception proxies, platform differences, and stale applications. These failures can cause widespread outages.

Core controls require teams to pin only with a justified threat model, include backup pins, plan rotation and recovery, monitor failures, and never disable normal hostname and chain validation. The Certificate Pinning boundary should identify the principal, credential or key, permitted audience, scope, lifetime, and revocation path.

Operational evidence should include application version, host, pin set version, matched key, certificate chain, failure reason, and rotation date. Certificate Pinning should be documented alongside Access Token, API Base URL, and Certificate Management.

Least-privilege configuration for Certificate Pinning should be verified against the operations used by each environment and consuming service. A compromise response for Certificate Pinning should support rapid revocation, replacement, affected-client identification, and review of prior use.