Certificate pinning is a defence where a client refuses to trust a server unless its certificate, or its public key, matches a copy baked into the client. Normal TLS trusts any certificate signed by a recognised authority; a pinned client trusts only the specific one it expects, so a valid certificate from any other issuer is rejected.

Why it breaks interception

An intercepting proxy reads HTTPS by being a man-in-the-middle: you install its root certificate, and it issues a fresh certificate for each site. A pinned client ignores what the machine trusts and checks the key against its built-in copy, which the proxy's issued certificate does not match, so the connection fails. We confirmed this: a request pinned to a site's real key failed through mitmproxy and succeeded through a plain forwarding proxy, because the plain proxy never touches the certificate.

What you can and cannot do about it

  • Apps you build. Loosen or remove the pin in a debug build, or add the proxy's certificate to the pin set, so you can inspect traffic during development.
  • Apps you do not control. You cannot make a pinned app accept an intercepting proxy by trusting a certificate; the pin is inside the app. On a rooted or jailbroken device, tools exist to disable pins, but that is a different exercise from proxying.
  • Leave the host tunnelled. In Charles or mitmproxy, exclude the pinned host from decryption; you still see its connection, just not the contents.

Pinning versus a proxy

Pinning is about the certificate, not where traffic exits, so it does not stop you using a commercial proxy. A pinned app routed through an HTTPS proxy connects fine, because the proxy tunnels the encrypted bytes without reading them. Pinning only bites when something tries to decrypt in the middle.

Common confusion

A pinning failure looks like a proxy problem, but it is the opposite: it means TLS is working as designed and refusing an impersonation. The fix is to stop intercepting that host, not to turn off certificate verification, which would remove the protection pinning adds.