Simple definition
Certificate pinning restricts a TLS client to an expected certificate, public key, or fingerprint instead of relying only on the normal certificate trust chain.
Technical definition
During the TLS connection, the application performs normal certificate validation and then compares a value presented by the server with a value stored in the application. Depending on the implementation, the pin can target the end-entity certificate or a public key.
How it works / role
Its role is to add an application-specific trust constraint. Even if a normally trusted certificate authority issues an unexpected certificate, the application can reject the connection when the configured pin does not match.
What is it used for?
Reduce the risk of TLS interception in controlled applications such as mobile or embedded clients where the service identity is known in advance.
Practical example
A mobile application pins the public key used by its API. A certificate renewal using the same key continues to work, while an unexpected new key is rejected unless it was planned.
Common issues
- Certificate expires or rotates without an updated pin
- Public key changes unexpectedly
- Corporate TLS inspection proxy becomes incompatible
- The application is locked out because no backup or rotation strategy exists
Key takeaway: Pinning can strengthen trust but increases operational risk during certificate rotation; always design a safe update strategy.