certificate pinning
termsecurity
Requiring that a server present one specific certificate or public key, rather than any certificate a trusted authority will sign.
Ordinary validation asks whether some authority the device trusts vouches for this name, which means any of hundreds of authorities - or any authority installed on the device - will do. Pinning narrows that to a named key, and so defeats interception even when the intercepting certificate is technically valid. It is standard in mobile applications and in anything talking to a fixed backend. The browser version, HTTP Public Key Pinning, was specified in 2015 and abandoned: a site that pinned a key and then lost it made itself unreachable to returning visitors for the lifetime of the pin, and the failure was unrecoverable, so browsers removed support in favour of certificate transparency. The operational consequence in an enterprise is unavoidable: an application that pins correctly will simply fail behind an inspecting proxy, and the resolution is always an exception list rather than a technical reconciliation.
Also known as: certificate pinning, public key pinning, hpkp, ssl pinning