Definition
Certificate pinning is a security technique where a client application explicitly trusts a specific digital certificate or public key for a given server, rather than relying solely on the server's certificate chain validation. Instead of trusting any certificate issued by a trusted Certificate Authority (CA), the client is configured to only accept a pre-defined certificate or key. This prevents man-in-the-middle attacks by ensuring the client only communicates with the legitimate server. For instance, a mobile banking app might pin the bank's server certificate to prevent attackers from intercepting sensitive transaction data. This differs from standard TLS/SSL where clients trust any certificate signed by a recognized CA. Certificate pinning is a key concept tested on exams like Security+ and CISSP.