Implementing TLS Pinning in Android to Protect Against MITM Attacks

By default, Android apps trust any certificate signed by a trusted Certificate Authority, which allows an attacker on a public Wi‑Fi network to install a malicious certificate and intercept traffic. Certificate pinning, also known as TLS pinning, changes this behavior so the app only accepts a specific certificate or public key, rejecting any other valid certificates. In Android, OkHttp’s `CertificatePinner` can be configured with a SHA‑256 hash of the server’s public key, as shown in the code example, and the hash can be generated with an OpenSSL pipeline that extracts the public key and computes its base64‑encoded SHA‑256 digest. Pinning mitigates man‑in‑the‑middle attacks but introduces operational discipline: you must handle certificate rotation, avoid hard failures in production, and understand when pinning adds value versus relying on backend security.

The trade‑offs include the need to update the pin whenever the certificate changes and the risk of breaking the app if the pin is incorrect. Pinning strengthens the transport layer without replacing existing security models, and should be used when the app handles sensitive data such as finance or health. Developers should plan for rotation and monitor pin failures to maintain a secure mobile app. The approach is most valuable when the app handles sensitive data, but it adds operational overhead that must be managed.