📌

TLS Certificate Pinning

Medium

Free preview · 2 of 5 steps

The CA trust problem

Standard TLS trusts any of ~150 certificate authorities in your OS trust store. Any of these CAs could issue a valid certificate for your app's domain — if compromised or coerced. In 2011, DigiNotar (a Dutch CA) was hacked; attackers issued fraudulent Google/Facebook certs. Corporate TLS inspection proxies use custom root CAs for exactly this 'feature'.

Certificate pinning limits trust to a specific certificate or public key, preventing any CA mismatch.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step