加入憑證固定前，先制定金鑰輪替方案

Certificate pinning can narrow the credentials an application accepts, but it also adds a dependency between the server and shipped clients. For a beginner evaluating pinning, the most useful first artifact is a rotation story: what happens when the accepted key needs to change?

Design checklist; no pinning configuration has been deployed.

List what the application would pin

A certificate, a public key and an issuer restriction have different replacement behavior. Do not use the word pin without specifying the object and the implementation that enforces it. Check the platform documentation before choosing a configuration.

Android documentation explicitly discusses the operational risks of pinning and recommends caution. A copied example is not evidence that pinning is appropriate for your application.

Imagine the old clients

Consider an app installed on a phone that has not received an update for months. If the server moves to a key the client does not accept, that client may lose connectivity. Your recovery plan cannot depend entirely on fetching an update through the connection that is now blocked.

This is a hypothetical failure exercise. It does not mean every pinning deployment fails, but it reveals a dependency you need to own.

Design the change before enforcing it

Document the current accepted material, backup material where supported, client update path, overlap period and conditions for retirement. Some platforms support a pin expiration time; understand what protection remains after that time instead of treating it as a free recovery mechanism.

Also consider an emergency key compromise. Keeping an old compromised key accepted merely to avoid disruption can defeat the reason for changing it.

Use an acceptance table

Create rows for current clients, delayed updates, planned rotation, emergency rotation and recovery without the old endpoint. For each row, state expected behavior and the evidence you need.

If you cannot maintain that lifecycle, reconsider the design with the platform security guidance. Pinning is a continuing compatibility and security commitment. The value of this exercise is finding that commitment before users depend on it.

Primary sources

• Android: Network Security Configuration

Further reading on PKI Channel

The following Japanese-language guides add diagrams and operational detail to the questions discussed above.

• Certificate Pinningの考え方 (Japanese)
• 鍵アルゴリズム移行の進め方 (Japanese)

AI was used for research assistance, writing and illustration. Examples and checklists are explanatory, not reported lab results.