Verified65% confidenceSolutionExact time
Certificate pinning can defend against man-in-the-middle attacks: even if an attacker holds a valid certificate issued by a trusted CA, the connection is still rejected as long as the public key hash does not match the pinned value.
3
Sources
65%
Confidence
Long-term
Relevance
10/8/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedA rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.80% similarUnverifiedFor high-security scenarios, certificate pinning can effectively defend against man-in-the-middle attacks caused by compromise of an intermediate CA, but flexibility and operational complexity must be weighed.77% similarUnverifiedSSL Pinning机制在客户端代码中硬编码服务器证书的公钥指纹或证书哈希，拒绝接受非预期CA签发的证书，即便该CA已被系统信任库收录76% similarUnverifiedCA (certificate authority) keys are the root of trust in public key infrastructure; once leaked, attackers may forge certificates and then carry out man-in-the-middle attacks or impersonate legitimate services.76% similarUnverifiedAfter the intermediate CA private keys leak, attackers could theoretically forge valid TLS certificates for any domain.75% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/987553API
curl https://kongchang.com/api/v1/knowledge/claims/987553MCP
get_claim(id=987553)