An app can reject a connection even when the server’s certificate passes ordinary checks. One possible reason is certificate pinning: the app expects a particular certificate or public key in addition to the normal trust requirements.
The OWASP Pinning Cheat Sheet explains the distinction between pinning certificates and public keys, and the operational risks. Pinning is a design decision for a particular threat model. It is not a universal setting that every app should add automatically.
The extra restriction has an expiry problem
A service needs to replace certificates and may need to change keys. If an app only accepts an old value, a legitimate change can make the service unavailable to users whose app has not been updated. Pinning a public key can avoid some certificate-renewal changes, but it does not remove the need to plan for key rotation.
Consider an illustrative deployment: a team releases a new server certificate on Monday, while a customer opens an app version last updated six months earlier. The server may be operating correctly, yet the app’s stored expectation is obsolete. A successful test on the developer’s newest build would miss that customer experience.
Ask about recovery before adding the check
- Which server and client teams control the certificates, keys and releases?
- How will supported older app versions handle a planned rotation?
- What happens if a key must be replaced urgently?
- How will a failed pin be distinguished from other connection failures?
These questions belong in the design review alongside any security benefit. Testing should cover the lifecycle, including older supported clients and the intended recovery process.
For an ordinary user, a connection error is not an invitation to disable certificate checks or install an unknown certificate. Record the app version and error, then use the provider’s support route. The right fix should preserve a trustworthy connection while restoring compatibility; a warning that disappears is not, by itself, evidence that the underlying problem has been solved.