Certificate Pinning
debt(d7/e7/b7/t7)
Closest to 'only careful code review or runtime testing' (d7). The detection_hints list burpsuite and mitmproxy as tools, but these require active interception testing — there is no automated static analysis that flags missing or misconfigured pinning. The absence of pinning is silent in normal operation; you only discover it when deliberately probing with a proxy tool or during a security review.
Closest to 'cross-cutting refactor across the codebase' (e7). The quick_fix notes that pinning requires bundling public key hashes, maintaining backup pins, and a rotation plan. The common_mistakes list reveals that a correct implementation touches mobile app code (pin logic, fallback pins), server-side override/rotation mechanisms, CI/CD pipelines for debug vs. release builds, and operational runbooks for key rotation — this spans multiple systems and teams, not a single-file fix.
Closest to 'strong gravitational pull' (b7). Once pinning is adopted, every certificate rotation becomes a coordinated event across mobile app releases and server infrastructure. The common_mistakes confirm this: missing backup pins turn a routine rotation into an outage, and hardcoded pins without a server-side override mechanism create permanent operational risk. The applies_to scope (web/api with mobile clients) means this choice shapes ongoing deployment and release processes throughout the product lifecycle.
Closest to 'serious trap' (t7). The misconception field explicitly states that developers believe pinning makes an app immune to interception, when in reality it is bypassed via Frida hooking, patched APKs, or pin expiry without fallback. Additionally, the common_mistakes show multiple non-obvious failure modes: pinning leaf certs that rotate frequently, omitting backup pins, hardcoding without override — all of which contradict what a competent developer would intuitively do when first implementing pinning.
Also Known As
TL;DR
Explanation
Certificate pinning supplements the CA trust model by associating a host with its specific certificate or SPKI hash. Even if an attacker obtains a fraudulent certificate from a trusted CA, a pinning client rejects it. In PHP CLI/service contexts, cURL supports pinning via CURLOPT_PINNEDPUBLICKEY. Trade-off: pinned certificates must be rotated before expiry — missed rotation causes outages; key compromise requires emergency pin updates. HPKP (the HTTP header equivalent) was deprecated due to abuse potential. Combine with Certificate Transparency monitoring as a complementary server-side control.
Common Misconception
Why It Matters
Common Mistakes
- Pinning the leaf certificate rather than the intermediate or root CA — leaf certs rotate frequently.
- Not including backup pins, making a key rotation an outage.
- Hardcoding pins in code without a server-side override mechanism for emergency updates.
- Disabling pinning in debug/test builds, which attackers can exploit by triggering debug mode.
Code Examples
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);curl_setopt($ch, CURLOPT_PINNEDPUBLICKEY, 'sha256//AbCdEfGhIjKlMnOpQrStUvWxYz==');