iOS SSL Pinning: Certificate vs Public Key Pinning

iOS developers can secure network traffic by implementing SSL pinning, but the platform’s low‑level networking stack requires manual handling of URLSessionDelegate and Security.framework. The article contrasts two pinning strategies: certificate pinning, which compares a .cer file at runtime, and public key pinning, which compares the server’s public key hash and survives certificate renewal. Certificate pinning is fragile because any renewal changes the .cer file, forcing an app release; public key pinning is recommended for production as it remains stable across renewals.

The guide walks through the steps for certificate pinning—exporting the backend certificate, adding it to Xcode, and comparing it in the delegate’s urlSession:didReceive:completionHandler: method. It then shows a public key pinning example using Alamofire’s PinnedCertificatesTrustEvaluator and ServerTrustManager to configure a secure evaluator for the API domain. The article also clarifies that pinning protects against MITM but does not authenticate users or protect API access.

For maintainability, the author recommends using a library like Alamofire instead of hand‑coding the pinning logic, and stresses that pinning should be part of a broader mobile security strategy, not a silver bullet.