Let's Encrypt renews the certificate Tuesday morning. The website recovers smoothly — but the iOS mobile app stays offline for 40% of users still on the old version. Cause: certificate pinning on the old public key, no backup pin, no anticipated App Store release.
HPKP is gone from browsers; pinning mainly affects native apps, embedded agents, and some SDKs. It ties mobile availability to certificate cycles and store review delay — an explosive combination without governance.
Pin certificate or public key
You usually pin the SPKI hash of the public key — more stable than a full certificate if the CA reissues with the same key. Document algorithm (SHA-256) and value in a shared mobile + infra inventory.
Monthly spreadsheet: app version, active pin, backup pin, prod cert expiry, last store release date.
Backup pin mandatory in practice
A single pin = total outage on renewal. The backup pin (second SPKI hash) must ship before prod cert swap. Calendar: App Store submission before cert change, not after incident.
Security ADR: pin yes/no with threat model. If no: Certificate Transparency monitoring + automated short-lived certs.
Modern alternatives
| Approach | When |
|---|---|
| CT monitoring | Apps without extreme pinning constraint |
| App mTLS | B2B API, not public store |
| Pin + backup | Documented targeted MITM threat |
mTLS and CT often reduce the need to couple cert ops and mobile release.
Release day protocol
Renewal day: mobile crash dashboard open, infra + mobile war room, rollback app version ready, pre-written support comms.
Staging test with future cert/key before prod swap — no store review surprise.
Hosting and renewal
Automate prod ACME web; separate mobile API cert if different endpoints. Verify renewal does not change key without notice (some CA migrations).
Compare hosts on cert API and support delays if pinning active — directory and comparison tool sheets.
Pin inventory
Spreadsheet: app version, pin hash, backup pin, cert expiry, last mobile release. Review monthly security meeting — pin surprises become scheduled work.
If mobile team insists pin, require backup pin and signed approval from security lead accepting App Store coupling.
Consider public key rotation schedule aligned with cert CA renewal calendar shared in joint Slack channel.
Operational follow-up
Annual review: pin still justified by threat model or legacy to remove. ADR decision doc accessible to mobile and infra. Mobile crash spike graph open on cert rotate release day — war room protocol. Document gaps between host marketing and field measurement in the quarterly review.
Quarterly follow-up
Annual review: pin still justified by threat model or legacy to remove. ADR decision doc accessible to mobile and infra. Mobile crash spike graph open on cert rotate release day — war room protocol. Document gaps between host marketing and field measurement in the quarterly review.
Certificate Transparency alerts on new certs complement or replace pinning depending on threat model.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Keep a dated runbook, before/after metrics, post-incident review — cumulative discipline beats Friday night panic.
Operational follow-through
Keep a dated runbook, quarterly review with business teams, and before/after metrics for each change. Document gaps between host marketing and field measurement: latency, quotas, restore, support. To compare infrastructure and read more field notes, browse our directory, comparison tool, and technical blog guides — a documented decision beats an upgrade bought in Friday night panic.
Decide and move forward without blind spots
- Inventory pinned apps — mobile squad, linked cert expiry date, backup pin present or absent.
- Cert calendar = release calendar — App Store submission before prod key swap.
- Staging test new key — crash monitoring dashboard open on release day.
- Alternatives first — CT monitoring, HSTS, mTLS; pin only if hostile network MITM threat.
- Quarterly security register — SPKI rotation overlap measured in weeks.
TLS and hosting: directory, comparison tool, TLS guides.
Frequently asked questions
Does HPKP still exist in browsers?
No — Chrome and Firefox removed HPKP. Pinning mainly affects native mobile apps and some embedded agents.
Pin certificate or public key?
You usually pin the SPKI hash of the public key, more stable than a full certificate if the CA reissues with the same key.
Is a backup pin mandatory?
Practically yes: a second pin avoids total outage on renewal. A single pin ties availability to the App Store cycle.
What alternatives to pinning?
Certificate Transparency monitoring, automated short-lived certs, app mTLS — often enough without coupling cert ops and mobile release.
Annual review: is pin still justified by threat model or legacy to remove?