Certificate Pinning / HPKP (Certificate Pinning)
Why Certificate Pinning Matters
Certificate pinning was designed to protect against rogue or compromised CAs issuing fraudulent certificates. Even if an attacker obtains a valid certificate from a different CA, a pinned client would reject it because the public key does not match the pinned value.
HPKP was removed from browsers because of its extreme risk profile. If a site operator set incorrect pins, lost their pinned keys, or needed to switch CAs, the site became completely inaccessible to browsers that had cached the pins - potentially for weeks. Several high-profile incidents demonstrated this risk, and the browser community concluded that Certificate Transparency was a safer solution to the same problem.
Certificate pinning still exists in mobile apps and API clients where the developer controls both ends of the connection. Mobile app pinning is a legitimate security measure, though it requires careful key rotation planning. For websites, CT monitoring has replaced pinning as the recommended approach to detecting unauthorized certificates.
How to Test for Certificate Pinning
Check if your server sends the deprecated Public-Key-Pins header using a security audit tool. If present, you should remove it - HPKP is no longer supported by major browsers and can cause availability problems. For mobile apps, pinning configuration is checked during app security testing.