> For the complete documentation index, see [llms.txt](https://calvin-lai.gitbook.io/calvin-lai-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://calvin-lai.gitbook.io/calvin-lai-security/penetration-testing/mobile-penetration-test/certificate-pinning.md).

# Certificate Pinning

A security technique used in mobile app to ensure that the app communicates only with a specific server by validating the server's certificate against a known, hardcoded certificate or public key.

This helps prevent man-in-the-middle (MITM) attacks, where an attacker intercepts and potentially alters the communication between the app and the server.

#### How Certificate Pinning Works

1. **Hardcoding Certificates:** The app includes the expected server certificate or public key within its code.
2. **Validation:** When the app establishes a secure connection (e.g., HTTPS), it checks the server's certificate against the hardcoded certificate.
3. **Blocking Untrusted Certificates:** If the server's certificate doesn't match the hardcoded certificate, the app will block the connection, preventing potential MITM attacks.

#### Benefits of Certificate Pinning

* **Enhanced Security:** By ensuring that the app communicates only with the intended server, certificate pinning significantly reduces the risk of MITM attacks.
* **Protection Against Compromised CAs:** Even if a Certificate Authority (CA) is compromised, certificate pinning ensures that the app will not trust fraudulent certificates issued by the compromised CA.
* **Increased Trust:** Users can have greater confidence that their data is being transmitted securely and to the correct server.

#### Implementation Challenges

* **Certificate Rotation:** When the server's certificate is renewed or changed, the app's hardcoded certificate needs to be updated, which can be a complex process.
* **Maintenance:** Regular updates and maintenance are required to ensure that the pinned certificates remain valid and secure.