An iOS pinning decision affects certificate changes, older clients and recovery. Assess the protection requirement alongside long-term operational capacity.
Evaluation approach
Identify the connection layer that performs trust evaluation. Custom code that incorrectly bypasses platform verification can reduce security instead of improving it.
Application example
Before renewing a certificate, verify whether older application releases will work with the new key.
Limits and considerations
Omitting hostname checks or accepting every error defeats the purpose of pinning.
Renewal is an acceptance scenario
When a pinned server certificate or key changes, the behavior of older releases must be known. If backup expectations and a transition process exist, verify that the working distribution package actually contains them. A theoretical plan is insufficient.
When a check fails, explain the problem and a safe next step to the user. Automatically trusting an invalid peer can remove the protection entirely. Account for the possibility of in-app interference affecting network checks in the threat model.
Checks and decisions
- Retain platform verification
- Plan backup keys
- Test older releases
Rehearse the transition with the final package before an outage occurs.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.