Certificate pinning

Certificate pinning narrows trust. Normal TLS accepts any certificate that chains to a trusted certificate authority, which means a single compromised or coerced CA can issue a valid certificate for a site it does not own. Pinning defeats that by telling the client, in advance, exactly which certificate or public key to expect for a given service. Anything else is refused, even if it validates perfectly against the CA trust store.

The design decision the exam cares about is what to pin. Pinning the full certificate fingerprint is strict but breaks on every renewal; pinning the public key hash survives renewal as long as the key pair is reused; pinning a higher chain element trades some security for flexibility. That first choice, the trust anchor, is the subject of the certificate pinning insight. The main operational risk is rigidity: a mismatched or expired pin can lock legitimate users out entirely.

Exam relevance: pinning is the answer to “how do you defend against a rogue or compromised CA issuing a fraudulent certificate”. Know the trade-off, that tighter pinning raises maintenance burden and outage risk, and the ranking of pinning targets: public key hash for durability, full certificate for strictness.