# What Is Certificate Pinning? Definition and Examples

> Certificate pinning is a client-side check that accepts a server only if its certificate chain contains a specific, pre-configured certificate or public key.

Source: https://ssl.sh/glossary/certificate-pinning/
Last updated: 2026-11-10

With certificate pinning, a client stores the expected certificate or, more commonly, a hash of a SubjectPublicKeyInfo (SPKI) for a host, and rejects connections whose chain does not match, even if that chain is otherwise valid and trusted. It is mostly used in mobile apps and IoT clients that talk to their own APIs. Browsers tried dynamic pinning through [HPKP](https://ssl.sh/glossary/hpkp/) (RFC 7469), but it was removed from Chrome in Chrome 72 because misconfigured pins could lock sites out.

## Why it matters
Pinning narrows trust from every CA in the trust store to the keys you choose, so a misissued certificate or a locally installed corporate root cannot intercept the app's traffic. That is also why pinned apps fail behind [SSL inspection](https://ssl.sh/glossary/ssl-inspection/). The risk is bricking: if the pinned key changes and no backup pin exists, every installed client stops connecting until it is updated. With maximum certificate validity at 200 days from 2026-03-15 and falling to 47 days from 2029-03-15, pinning a leaf certificate is fragile. Pinning a CA's [intermediate](https://ssl.sh/glossary/intermediate-certificate/) is not stable either; Let's Encrypt moved its issuance to new hierarchies in 2026. Pin SPKIs of keys you control, always ship a backup pin, and consider [Certificate Transparency](https://ssl.sh/glossary/certificate-transparency/) monitoring as a lower-risk alternative.

## Example
Compute a base64 SHA-256 SPKI pin, the format used by Android's Network Security Config and by the former HPKP header:

```bash
openssl x509 -in cert.pem -noout -pubkey \
  | openssl pkey -pubin -outform der \
  | openssl dgst -sha256 -binary | openssl enc -base64
```

## Common misconceptions
- **Pinning the leaf certificate is the safest choice.** It breaks at every renewal unless the key is reused; pin keys rather than certificates, and keep a backup.
- **HPKP still protects websites.** Mainstream browsers no longer enforce HPKP headers.
- **Pinning replaces normal certificate validation.** It is an extra check on top of chain and hostname validation, not a substitute for them.

## Related terms

- [HPKP](https://ssl.sh/zh/glossary/hpkp/): HPKP 是 RFC 7469 定义、现已废弃的 HTTP 响应头，要求浏览器只在证书链包含指定公钥时才接受该网站。
- [公钥](https://ssl.sh/zh/glossary/public-key/): 公钥是非对称密钥对中可以公开的一半，写在证书里，供他人验证由对应私钥生成的签名。
- [证书透明度](https://ssl.sh/zh/glossary/certificate-transparency/): 证书透明度（CT）是一套公开、只可追加的日志系统，记录所有公开信任的 TLS 证书，让任何人都能审计 CA 签发了什么。
- [SSL 解密检测](https://ssl.sh/zh/glossary/ssl-inspection/): SSL 解密检测是企业安全网关借助受管设备信任的私有 CA，对 TLS 流量进行解密、检查后再重新加密的做法。
- [中间证书](https://ssl.sh/zh/glossary/intermediate-certificate/): 中间证书是由根证书（或上级中间证书）签发、用来签发网站证书的 CA 证书，服务器必须把它和网站证书一起发送给客户端。
- [密钥轮换](https://ssl.sh/zh/glossary/key-rotation/): 密钥轮换是按计划或在安全事件后，用新生成的密钥替换旧密钥，以限制密钥泄露造成损失的做法。