I've dealt with cert pinning in the past, and the most frustrating part was invisible pins - any client can pin your certificate in their code, without ever hav

I've dealt with cert pinning in the past, and the most frustrating part was invisible pins - any client can pin your certificate in their code, without ever having told you about it. If you run a large enough API over TLS, always assume that some random client will have pinned your certificate at their end. The only way to deal with it is to setup fast rotating certs, so these enterprise clients just give up, but that might not always be possible We ended up doing slow brown-outs over a long time period to deal with it.