SSL pinning is not dead — it just needs a redesign.

Mobile applications have traditionally relied on static SSL pinning to defend against man-in-the-middle attacks. However, static pins introduce operational challenges, including certificate rotations, application updates, and recovery from compromised trust anchors.

This talk explores an alternative approach: a protocol-driven model that enables the secure exchange and validation of SSL pins between a mobile application and backend services. By moving beyond hardcoded trust relationships, organisations can improve resilience, reduce deployment friction, and maintain strong transport security without sacrificing agility.

We will examine the threat landscape, design considerations, trust-establishment mechanisms, and practical implementation patterns for securely distributing and validating pins at runtime. Attendees will leave with a fresh perspective on mobile trust models and a roadmap for building more adaptable, future-ready SSL pinning solutions.