Home▸Cybersecurity▸Certificate Pinning & MITM Defense

Certificate Pinning & MITM Defense (2D)

Interactive 2D canvas certificate-pinning simulator: a real ECDSA key pair, a real SPKI export and a real SubtleCrypto SHA-256 hash decide whether a man-in-the-middle attacker's CA-valid-but-unpinned certificate is accepted or genuinely rejected.

Cybersecurity2DModerate60 FPS📱 Mobile-adapted⇄ 3D version

Details

CategoryCybersecurity

RenderingCanvas 2D

DifficultyModerate

Target FPS60

ControlsToggle certificate pinning on/off, toggle an active MITM attacker, toggle whether a backup pin is staged, trigger a server certificate rotation, and adjust the connection attempt rate — while a live 2D handshake plays out between the app, server and attacker nodes, backed by real ECDSA key pairs and SubtleCrypto SHA-256 pin comparisons.

mobile securitycertificate pinningTLSMITMcybersecuritypenetration testing

Related simulations

TLS Interception at a Forward Proxy (2D)Interactive 2D diagram of SSL/TLS inspection at a forward security proxy: the proxy…

Certificate Revocation Race 2D: Detection-Latency DistributionsInteractive 2D Monte Carlo simulator: race CRL polling, live OCSP queries, and OCSP stapling…

Modular Exponentiation Clock: Key Exchange Under Attack (2D)2D companion to the 3D Diffie-Hellman key-exchange lab: watch the actual square-and-multiply… ⊞ All 534 in Cybersecurity →

This simulator plays out the exact decision a mobile app makes on every HTTPS connection, using real cryptography end to end: a real ECDSA P-256 key pair per node (app-trusted server, and — when active — a MITM attacker), a real SPKI export of whichever public key is presented, and a real SubtleCrypto SHA-256 hash compared byte-for-byte against a pinned hash constant. A normal CA-chain check alone (step 1) accepts any certificate the simulated CA is shown, which is exactly how a compromised CA or an installed MITM proxy root defeats plain TLS. Certificate pinning adds a second, independent real check: the freshly computed hash of the presented key must equal a hash hardcoded ahead of time. Toggle pinning and the MITM attacker to see interception succeed or genuinely fail on the real hash comparison, and use the certificate-rotation control to see pinning's own failure mode — locking out a legitimate key rotation — unless a backup pin was staged in advance.

⚙ Under the hood

Watch a mobile app's TLS handshake with its server in real 2D, toggle an SPKI-hash certificate pin and a man-in-the-middle attacker, and see exactly when pinning blocks the interception — or when an unstaged certificate rotation locks legitimate users out instead.

mobile securitycertificate pinningTLSMITMcybersecuritypenetration testing

2D · HTML5 Canvas 2D · 60 FPS target · runs fully client-side, no install