> it just doesn't seem like it's possible Mobile apps can do this with certificate pinning. Web apps used to be able to do this with HTTP Public Key Pinning (H

> it just doesn't seem like it's possible Mobile apps can do this with certificate pinning. Web apps used to be able to do this with HTTP Public Key Pinning (HPKP) [1], but it was deprecated because it was too much of a footgun. Instead you can monitor for certificates for your domain that aren't expected via Certificate Transparency logs. [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key...