If you pin at all, pin a leaf certificate or its public key and always include a backup pin. Pinning a root trusts every certificate under it, and pinning an intermediate trusts everything that authority issues. The leaf is the tightest choice but needs a plan for rotation so you do not lock users out.
The four things you can pin
The OWASP Pinning Cheat Sheet walks through the decision in two steps. First choose where in the certificate chain to pin. Then choose whether to pin the whole certificate or only its public key.
| What you pin | Trust you accept | Outage risk | Notes |
|---|---|---|---|
| Root CA | Every intermediate and certificate under it | Low | OWASP says this is generally not recommended |
| Intermediate or issuing CA | Anything that CA or its sub-CAs issue | Medium | Narrower than the root, still wider than your own hosts |
| Leaf certificate | Only your server certificate | High without backups | Recommended, but only with backups |
| Public key (SPKI) | Any certificate carrying that key | Lower | The pin can be computed before the certificate exists |
OWASP's reasoning for the leaf is that it gives certainty the app trusts only the hosts it was built for, while a backup adds resilience for failover or rotation.
Why a backup pin is mandatory
Imagine you pin one leaf and the certificate is replaced early because of a key compromise. Every installed copy of the app now refuses to connect, and the fix is an app update that users have to install.
A backup pin removes that trap. OWASP's example pins the leaf and adds a backup pin for the intermediate CA, accepting some extra trust in return for a lower chance of bricking the app. Android's documentation shows the same pattern in its network security configuration: a pin set with a primary pin and a backup pin, and the platform documentation warns that an expiry on pins can help avoid connectivity issues for apps that are not updated, but may let attackers bypass pinned certificates.
Certificate or public key
Pinning the certificate is the easiest to build. You can fetch it with a command line TLS client and compare it in the connection callback. The downside is that every renewal changes the certificate, so the app needs a matching update. OWASP notes that if you do not control when a certificate is put in service, pinning it will lead to an outage.
Pinning the public key is more flexible. OWASP recommends pinning the SubjectPublicKeyInfo, which carries the algorithm and key parameters. Because most certificates today are good for 90 days, key pinning gives a longer timeline, and you can pin a key before its certificate is even issued. If policy allows, renewing a certificate with the same key keeps pins working, though OWASP calls reusing keys bad key management practice and only for emergencies.
A practical pinset
- Generate a spare key pair for your server and keep it offline.
- Pin the SPKI of your current key and of the spare key.
- Optionally add the issuing intermediate as a last resort, accepting the wider trust.
- Write down who rotates the keys, how often, and the date by which a new app release must be live.
- Test a deliberate pin mismatch in a staging build so you know the failure path works.
- Monitor connection failures by app version after every certificate change.
Mistakes to avoid
- Pinning a root because it is stable. You trust far more than you meant to.
- A single pin with no backup.
- Pinning hosts you do not run, like analytics or payment partners.
- Assuming an expiry date solves rotation. An expired pin set stops protecting you.
Safeguard's SBOM and dependency scanning shows which networking and TLS libraries your app ships, so you know which implementation your pinning depends on. A free scan is at gold.safeguard.sh/scan.
Quick check
Is pinning the intermediate CA safer than pinning the leaf?
It is less likely to lock you out, but the app then trusts every certificate the intermediate issues, not only yours. OWASP treats it as a trade off, and it works as a backup.
Why pin the public key rather than the certificate?
A certificate changes at each renewal, while a key can stay the same or be prepared ahead of time, which gives you a longer window to update pins.
Sources
Last reviewed: 19 October 2026.
