Pin TLS Certificates for Mobile API Clients
Embed the expected certificate hash so a compromised CA or MITM proxy is rejected even if the chain is technically valid.
Task
Implement const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch'); to close a known attack surface before the next security review finds it.
When to use this
A penetration test report flags the missing const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch'); as a medium-severity finding on a public endpoint.
Prerequisites
- A running application with the vulnerable endpoint
- Access to security headers or middleware config
Steps
1. Configure const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch'); in the project configuration file with the recommended defaults.
const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch');
Expected output: The configuration is accepted and const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch'); runs without errors on the first invocation.
2. Run the check locally to verify const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch'); produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch'); blocks merge on failure.
- name: Run add tls cert pinning
run: pnpm test
Expected output: Pull requests with failing const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch'); are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Close the attack surface
Start by measuring the problem. Embed the expected certificate hash so a compromised CA or MITM proxy is rejected even if the chain is technically valid. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run const expected = ‘sha256/abc123…’; if (cert.fingerprint !== expected) throw new Error(‘pin mismatch’); against the current codebase and inspect the output before wiring it into CI.
const expected = 'sha256/abc123...'; if (cert.fingerprint !== expected) throw new Error('pin mismatch');Verify and monitor
Once the gate is in place, make failures actionable. A failing const expected = ‘sha256/abc123…’; if (cert.fingerprint !== expected) throw new Error(‘pin mismatch’); should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.