For mobile apps it's easier than for websites because native apps have more control over what's going on than the website, and can read the details of http conn

For mobile apps it's easier than for websites because native apps have more control over what's going on than the website, and can read the details of http connections (so in worst case, you can roll out your own pinning). For Android there are a built-in facilities for that in modern versions: https://developer.android.com/training/articles/security-config.html https://developer.android.com/training/articles/security-con... For iOS: not an expert, but this article seems good https://dzone.com/articles/ssl-certificate-pinning-in-ios-applications https://dzone.com/articles/ssl-certificate-pinning-in-ios-ap... It might get a bit trickier when WebViews are involved though because, at least on Android, SSL in WebView is subject to different security rules than the java-initiated connections (AFAIU the problems due to https://www.chromium.org/developers/androidwebview/webview-ct-bug https://www.chromium.org/developers/androidwebview/webview-c... could not have been avoided on the app side, for example, as it was a bug in Chromium).