Trust Management

Treat Certificate Pinning as a High-Cost Trust Decision

TLS normally lets a client authenticate a server through a certificate chain anchored in a trusted certificate authority. A developer may look at that broad trust model and decide to add certificate pinning: require the server to present not only a normally valid certificate, but also certificate or public-key material that the application already expects. That extra restriction can reduce risk in a narrow threat model. It can also turn an ordinary certificate or key rotation into an outage if the application has no usable replacement pin. For many applications, especially ordinary websites, the operational risk is not justified.