Packets launch from the phone toward the server along a fixed tunnel. Partway down, a ring-shaped pin-check gate samples each packet's certificate fingerprint. If pinning is on and the fingerprint doesn't match the one built into the app, the gate closes and the packet is deflected — no matter how trustworthy the certificate's issuing CA looked to the OS.
accept = chainValid(cert)
AND (pinningOff OR sha256(cert) == pinnedHash)
- Pinning On/Off — with the gate disabled, only the CA chain matters, so a rogue-CA certificate sails through untouched.
- MITM attack — spawns an interceptor node above the tunnel that hijacks a fraction of packets and re-signs them with its own certificate before they reach the gate.
- MITM cert: CA-valid / Self-signed — a self-signed certificate is stopped upstream of the gate entirely, by ordinary chain validation; a CA-valid one only stops if pinning is on.
- Packet rate — how many connections launch per second, for a faster read on the outcome mix.
Real-world relevance: this is the check that stops a corporate proxy, a coerced CA, or malware-installed root certificate from silently reading traffic a pinned mobile app sends — the gate cares about the exact certificate, not just who signed it.