Fix Network Certificate Pinning Failure Fast

You're trying to open a site or an app, and bam—certificate pinning failure. Frustrating, especially when you know the network works fine. I've seen this with small biz clients running their own apps or using corporate proxies. Let's fix it.

The Fix: Update the Pinned Certificate or Bypass the App's Expectation

The core problem is simple: the app or browser expects a specific certificate (a "pin"), but the server presented a different one. This happens when:

• The server's certificate was renewed and the pin wasn't updated in the app.
• A proxy or antivirus is intercepting traffic (like a corporate firewall).
• The app is using an expired or wrong pin in its code.

Here's the step-by-step fix depending on your situation:

1. If it's a website in a browser (Chrome, Edge, Firefox)

Browsers have built-in certificate pinning for some major sites (like Google, Facebook). If you see NET::ERR_CERT_PINNING_FAILURE, the browser's own pin list is outdated or the server's cert was swapped. Try this:

1. Clear your browser's SSL state. In Chrome, go to chrome://net-internals/#hsts and click "Delete domain security policies". Type the offending domain and hit delete.
2. Update your browser. Browsers update their pin lists silently. Outdated browser = stale pins.
3. If you're behind a corporate proxy (like Zscaler or Blue Coat), the proxy's certificate may not match the app's pin. Talk to your IT team to add the proxy cert to the app's trust store.

2. If it's a mobile app (Android/iOS)

Apps often pin their own certificates. Had a client last month whose Android inventory app stopped working after their certificate expired. The fix was to update the app or the server cert.

1. Update the app — the developer may have pushed a new pin in an update.
2. Install the updated server certificate — if you control the server, renew the cert and update the app's pin (requires app update).
3. Workaround for testing: On Android, you can disable pinning for the app using ADB command (requires root): adb shell settings put global certificate_transparent_pinning 0. Not recommended for production.

3. If it's a custom app you or your client built

This is common. I've helped a dozen clients where they hardcoded a certificate pin that expired. The fix: regenerate the pin from the new certificate and update the app code.

Here's how to generate a new pin from a certificate file:

openssl x509 -in yourcert.pem -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64

Take that output and replace the old pin in your app's code (usually a string in an SSL configuration class).

Why It Worked

Certificate pinning is a security feature that says "only trust this exact certificate". When the server changes its cert (renewal, new CA, proxy interception), the pin doesn't match, so the app blocks the connection. Updating the pin or the cert makes them match again. If you bypass with a proxy, you're trusting the proxy instead—good for corporate environments but not for public apps.

Less Common Variations

• Expired intermediate certificate — The server's chain includes an expired intermediate. The pin is for the leaf cert, but the chain validation fails. Fix: update the intermediate on the server.
• DNS hijacking — A rogue DNS redirects your app to a fake server with a different cert. The pinning failure actually protected you here. Don't bypass; investigate the network.
• iOS ATS (App Transport Security) — If your iOS app uses ATS with pinned certificates, and the server's cert changes, you'll get a silent failure. Check your Info.plist for NSAppTransportSecurity settings.
• Android Network Security Config — Same deal: pin-set in your network_security_config.xml needs updating if the server cert changes.

Prevention Tips

• Use certificate transparency (CT) logs — They help apps detect legitimate cert changes without hardcoding pins.
• Implement backup pins — Always pin two certificates: the current one and a backup (like a different CA or a future cert).
• Set up monitoring — Have a script that checks your server's cert expiration and the app's pin list. Get alerts before the cert expires.
• Test with a staging environment — Before renewing a production cert, test the new pin against your app in a dev environment.
• Use HTTP Public Key Pinning (HPKP) only if you're brave — HPKP is deprecated in browsers but still used in some apps. Avoid it; it's too easy to lock yourself out.

Remember: certificate pinning is a tool, not a religion. If you're pinning because you think it makes you invincible, you're wrong. Use it sparingly and always with an escape hatch.