What is SSL Pinning?
SSL pinning (certificate pinning) is a security technique that associates a host with its expected SSL certificate or public key, preventing man-in-the-middle attacks even if a certificate authority is compromised. The client rejects any certificate that does not match the pinned value.
How Does SSL Pinning Work?
SSL pinning works by embedding the expected certificate or its public key hash directly into the application code. When the application connects to the server, it compares the server's certificate against the pinned value rather than relying solely on the certificate authority (CA) trust chain. If the certificate does not match the pinned value, the connection is rejected. This protects against scenarios where an attacker obtains a fraudulent certificate from a compromised or malicious CA.
SSL pinning is primarily used in mobile applications and API clients where the developer controls the client code. For websites, HTTP Public Key Pinning (HPKP) was an equivalent browser-based mechanism but has been deprecated due to the risk of permanently locking users out if pins are misconfigured. Modern alternatives include Certificate Transparency (CT) logs, which provide public visibility into issued certificates, and the Expect-CT header. When implementing SSL pinning in mobile apps, it is critical to include backup pins and a mechanism for updating pins without releasing a new app version.