Mobile Networking · Encryption in Transit · Lesson 3 of 4

Certificate Pinning

See how some apps trust only their own server's key, and what that costs.

Trusting Only One Key

Normal HTTPS accepts any certificate that chains to a trusted root. Your phone trusts many CAs, and you can add more. That flexibility is also a weak spot. A rogue or hacked CA, or a root someone tricked you into installing, could vouch for a fake server.

Certificate pinning narrows that trust. The app ships with a fingerprint of the exact key, or the specific CA, it expects from its own server. Each time it connects, it compares the server's certificate with that pin. If they don't match, the app drops the connection, even when the phone itself trusts the certificate.

Many banking and payment apps pin. Android supports it through a settings file called Network Security Config, and iOS 14 added a similar built-in option for apps.

Websites mostly don't pin anymore. Browsers once supported a pinning feature for sites called HPKP. Site owners kept locking out their own visitors by mistake, and Chrome removed it in 2019.

On your own test phone with a proxy's root installed, pinned apps fail to connect while other apps keep working. Course 3 shows this in a lab.

Pins, Hashes and Backups

A pin is usually a hash of the server's public key. A hash is a short fingerprint calculated from data. Change the data even slightly and the fingerprint changes completely. On Android, each pin is written as a SHA-256 hash, the only algorithm that format currently supports. Apple's built-in iOS option uses SHA-256 as well.

Pinning has a real cost. Servers change keys and certificates over time. If an app is pinned to an old key and the server moves on, every copy of the app stops connecting until users install an update. Android's documentation tells developers to always include a backup pin for a key they can switch to later. Pins can also get an expiry date, after which the app falls back to normal certificate checks.

Because of these risks, some teams pin to their CA instead of a single key, and some skip pinning and rely on the standard checks.

Security researchers sometimes bypass pinning on their own test devices to study an app. That's fine on your own phone or with written permission, and nowhere else.