Certificate pinning definition
Certificate pinning, also known as HTTP Public Key Pinning (HPKP), is a security mechanism that enhances the trust and security of a website's SSL connection.
Certificate pinning allows a website to specify its SSL certificate's unique fingerprint (public key) to a web browser. The browser then remembers this fingerprint and checks it during future connections to ensure a secure and trusted connection, mitigating the risk of fake or fraudulent certificates.
Certificate pinning protects against man-in-the-middle (MITM) attacks and certificate impersonation.
See also: certificate-based authentication
How certificate pinning works
- During the initial connection, the website sends its SSL certificate to the browser during the initial connection.
- The website includes an HTTP header with fingerprints (hashes) of trusted public keys that the browser should remember.
- The browser stores these fingerprints for future reference.
- On subsequent visits, the browser checks if the certificate matches stored fingerprints.
- If there's a match, the connection is trusted; if not, a warning is displayed to prevent potential security risks.
Certificate pinning types
- HTTP Public Key Pinning (HPKP) — In HTTP Public Key Pinning (HPKP), the server tells the client's web browser which specific public keys or certificates to remember and trust. However, HPKP has been deprecated due to the risk of accidental lockouts caused by misconfiguration or expired/revoked keys.
- Certificate Transparency (CT) based Pinning — This method uses publicly accessible logs of SSL/TLS certificates. Website owners can specify which certificates are valid for their domain by providing details about the certificate's log entry.
