SPKI pinning is a client-side defense that remembers the Subject Public Key Info, or SPKI, of a server certificate and accepts connections only when the server presents the expected public key. Instead of trusting any certificate signed by a public CA, the client verifies that the server’s key matches a known value. This reduces the chance that a forged or misissued certificate can be used for impersonation.
In practice, SPKI pinning matters when TLS trust depends on more than basic certificate validation. It can protect high-value API clients, mobile apps, and internal services from man-in-the-middle attacks, especially if hostname verification or CA trust is misconfigured. Defenders use it as an extra control, often alongside normal TLS checks, because it narrows the set of acceptable server identities. The tradeoff is operational: if the server’s key changes during rotation, the client must be updated or connections will fail.