Certificate Pinning

Certificate pinning adds a policy that an accepted certificate or public key must match a configured expectation for the service. It narrows the trust decisions a client makes beyond ordinary certificate-chain validation.

Operational planning is essential because certificate or key rotation can otherwise break clients. Pinning must define update and recovery behavior, and a pin check does not replace hostname checks or the other validation required by the intended TLS policy.