Certificate pinning is the practice of restricting trust to a specific certificate, public key, or expected trust set rather than any broadly trusted issuer. It matters because broad trust stores can allow unexpected but technically valid certificates that an organization never intended to accept.
What is Certificate Pinning?
Pinning helps a client recognize when a presented certificate or public key differs from the one it expects. It can reduce some risks from misissuance or trust-store abuse, though poor pinning design can also create brittle outages if legitimate certificate changes are not handled carefully.
What Certificate Pinning Commonly Supports
Common uses include mobile app trust hardening, internal service trust restriction, sensitive API protection, and additional defense against unexpected certificate substitution.
Certificate Pinning vs. Generic Trust Store Validation
Generic validation accepts any certificate chaining to a trusted issuer. Pinning narrows that acceptance to a smaller expected set.
Frequently Asked Questions
Why use certificate pinning?
Because it can reduce reliance on the full public trust ecosystem when a client should trust only a much smaller subset.
What is the tradeoff?
Operational errors during rotation or renewal can break connectivity if the pin set is not managed carefully.
Related Cybersecurity Terms
Stay ahead on Certificate Pinning. Get the weekday brief on what changes next.
A concise weekday read on the developments that matter to Certificate Pinning and the risks worth acting on.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
