Certificate pinning
Certificate pinning is a control in which an application accepts only a specific certificate or public key for a server, rather than any certificate signed by a trusted authority.
Pinning defends against an attacker who can install a certificate authority on the device — through malware, a hostile network, or a coerced user. Without it, adding a CA to the trust store is enough to read and modify supposedly protected traffic.
Pinning is a control worth verifying rather than assuming: it is commonly implemented on the primary API host and forgotten on analytics, advertising, crash-reporting and image endpoints, which frequently carry more identifying data than the pinned channel does.
Pinning also complicates authorised testing, which is why interception in a controlled environment is a normal part of a mobile assessment rather than an attack on the control.
Related terms
- Man-in-the-middle interception — Man-in-the-middle interception is the positioning of a proxy between an application and its servers so that traffic, including TLS-protected traffic, can be read and modified in transit.
- OWASP MASVS — The OWASP Mobile Application Security Verification Standard is a framework that defines what a mobile application must satisfy to be considered secure, organised into control groups covering storage, cryptography, authentication, network, platform interaction, code quality and resilience.
- Transport Layer Security (TLS) — Transport Layer Security is the protocol that encrypts and authenticates traffic between a mobile application and the services it talks to.