What is Certificate Pinning?

Certificate pinning, known as certificate authentication, is a security measure designed to prevent specific attacks like man-in-the-middle attacks. This is done by authenticating the SSL/TLS certs servers use to establish secure connections with their clients (like browsers).

Typically, when clients connect to a server via HTTPS, they verify the server’s certificate with a trusted authority (CA) to confirm its validity. Unfortunately, this can leave servers vulnerable to attacks when an attacker presents fake certificates that appear legitimate to clients.

Certificate pinning is a way to add an extra layer of security. Clients can specify the certificates or hashes of public keys they expect from servers by embedding those directly into client applications or configuration files. When connecting to servers, clients check if the received certificates match their desired ones based on the pinned value. If they don’t, they assume the connection is unsafe and terminate it immediately.

Certificate pinning provides several benefits. It reduces the reliance on CAs, and their potentially vulnerable infrastructure and protects users from attacks where rogue CAs are issuing fraudulent certificates. Pinning can also be used to strengthen security alongside standard certificate chains.

Certificate pinning is a complex process that requires careful management. It can make rotations and updates more difficult. If the server’s certificate is updated, clients who use pinned certificates may not trust the new version until they update their values to match that of the updated ones. This can cause problems during certificate renewals or migrations.

I recommend visiting OWASP and Zimperium’s Mobile Security Glossary to learn more about mobile security.