Thư viện · Đường truyền
TLS pinning without locking yourself out
Pinning stops intercepting proxies even when the machine trusts a forged certificate. Done carelessly, it can cut every shipped build off the moment you change certificates.
Pin the key, not the certificate
Pin the public key (SPKI). Certificates renew every few months; keys can live longer.
Always ship a backup pin
Ship at least two pins: the current key and a spare key generated in advance and kept offline. When you must switch, move to the spare and old builds still connect.
A rotation plan
- Add the new pin to a release and wait until most users update.
- Move the server certificate to the new key.
- Drop the old pin in a later release.
Corporate networks
TLS-inspecting proxies at work will be blocked by pins. Show a clear error and consider a warn-only mode for enterprise buyers.
Limits
Browsers do not allow pinning. It only means something in native or Node SDKs.
With ClavisAUH
Two-way signatures already stop tampering. Certificate Pinning adds protection against eavesdropping, and you add it to your software through the Protection Kit.