What Is Certificate Pinning?

Certificate pinning is a security technique in which an application is hard-coded to trust only a specific certificate or public key for a given server, rejecting any other certificate even if it is validly signed by a trusted Certificate Authority.

Certificate pinning locks an application to one expected certificate or public key per server, instead of trusting any certificate a valid CA has issued. This blocks man-in-the-middle attacks that rely on a mis-issued or fraudulently obtained certificate, since the pinned application rejects anything that does not match its embedded pin.

Key Takeaways

• Pinning can target the full certificate, the public key only, or the CA that issued it, with public-key pinning being the most common and renewal-resilient approach.
• Public-key pinning survives certificate renewal as long as the same key pair is reused, while full-certificate pinning breaks on every renewal unless the app is updated.
• Pinning is most valuable in mobile apps and IoT firmware, where an attacker who compromises a CA or DNS cannot simply substitute a validly signed but unauthorized certificate.
• The main operational risk of pinning is a lockout: if the pinned key changes unexpectedly and the app cannot be updated in time, legitimate users are locked out of the service.
• Browsers largely moved away from static, browser-level pinning (HPKP) due to lockout risk, but pinning remains common at the individual application level, especially in mobile.

What are the Three Types of Certificate Pinning?

Pinning type	What is pinned	Survives certificate renewal?
Full-certificate pinning	The exact certificate bytes	No; breaks on every renewal unless the app is updated
Public-key pinning	Only the public key inside the certificate	Yes, if the same key pair is reused across renewals
CA pinning	The issuing Certificate Authority	Yes, but offers weaker protection since any certificate from that CA is still trusted

Why Does Public-key Pinning Survive Renewal Better than Full-certificate Pinning?

A certificate renewal typically reuses the same underlying key pair, changing only the certificate’s validity dates and serial number. Public-key pinning checks only the key itself, so a renewed certificate built on the same key pair still passes validation. Full-certificate pinning checks the entire certificate, including fields that change at every renewal, so it fails the moment a certificate is renewed unless the pinned value is updated in the app at the same time.

What is the Lockout Risk with Certificate Pinning?

If a pinned key or certificate changes, whether through routine rotation, a compromised key requiring emergency reissuance, or a migration to a new CA, and the application cannot be updated with the new pin before that happens, users are locked out entirely: the app will refuse to connect to its own legitimate server. This is why pinning requires careful operational planning, typically pinning both a current and a backup key, so a rotation does not strand users.

Why Did Browsers Move Away from HTTP Public Key Pinning (HPKP)?

HPKP let websites instruct browsers to pin their certificate via an HTTP header. Browsers deprecated it because the lockout risk was severe at internet scale: a misconfigured or accidentally expired pin could make an entire site unreachable for every visitor, with no way to recover except waiting out the pin’s lifetime. Certificate Transparency monitoring has largely replaced HPKP’s goal of detecting mis-issuance, without carrying the same lockout risk.

How Encryption Consulting Helps

How Encryption Consulting HelpsCertSecure Manager tracks every certificate and key rotation across your estate, giving mobile and IoT teams the visibility they need to update pinned keys before a rotation causes a lockout. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

Is certificate pinning still recommended?

Certificate pinning remains common and valuable at the individual application level, particularly in mobile apps and IoT firmware, even though browser-level pinning (HPKP) was deprecated due to its severe lockout risk at internet scale.

What is the difference between certificate pinning and Certificate Transparency?

Certificate pinning is a preventive control built into a specific application that rejects any certificate not matching its embedded pin. Certificate Transparency is a detective control that lets anyone monitor which certificates have been issued for a domain, without blocking connections itself.

What happens if a pinned certificate expires unexpectedly?

If an app is not updated with the new pin before the old one expires or is rotated, the app will reject connections to its own legitimate server, locking users out entirely. This is why pinning strategies typically include a backup pin for the next expected key.

Should I pin the full certificate or just the public key?

Public-key pinning is generally preferred, since it survives certificate renewal as long as the same key pair is reused, whereas full-certificate pinning breaks at every renewal unless the application is updated in lockstep.

Track Every Key Rotation Before It Breaks a Pinned App

Take the next step CertSecure Manager gives you full visibility into certificate and key rotations across your environment, so pinned mobile and IoT applications never get locked out unexpectedly. See CertSecure Manager in action.