That depends. I'm not sure what iOS or Android do here, but Chrome (as an example, since its behavior is well-documented) does not perform pin validation when

That depends. I'm not sure what iOS or Android do here, but Chrome (as an example, since its behavior is well-documented) does not perform pin validation when the presented certificate chains up to a private trust anchor (i.e. a user-installed root cert) [1]. This was a deliberate choice on the part of the Chrome team, to allow this type of MITM (presumably because it's not uncommon in enterprise environments). [1] http://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- http://www.chromium.org/Home/chromium-security/security-faq#...