Skip to content
AI Security

Interview question · Network Security & Protocols

Leaf certificate, public key, intermediate or root: what should a client pin, and why did HTTP Public Key Pinning fail on the web?

Pinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.

hardNewPreparation tags: Google, Apple, MicrosoftUpdated Nov 2026

Pinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A team wants to pin certificates in their mobile app's connection to its API, which uses a public CA with 90-day certificates.

  1. Why is pinning the leaf certificate a bad idea?
  2. What about pinning the leaf public key?
  3. What about pinning a CA?
  4. What can go wrong operationally?
  5. Is pinning worth it?
  6. What would you recommend?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackHow would you secure remote access: a traditional VPN or zero-trust network access? What attacks target each?Next in this trackHow do SPF, DKIM and DMARC work together to stop email spoofing, and what do they not stop?Next in this trackHow do WPA2, WPA3 and enterprise Wi-Fi authentication work, and what attacks remain on wireless networks?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.