🔒SSL, TLS & Certificate Pinning

🌐How Secure Communication Works from Encryption to Trusted Connections

🚀Introduction

Every day, we log into applications, make online payments, and exchange sensitive information over the internet. Yet very few developers stop to ask a simple question:

How does my application know it’s really talking to the intended server?

Most of us recognize the small padlock icon in the browser and know that HTTPS is “secure,” but what actually happens behind the scenes?

• What is SSL?
• Why was TLS introduced?
• What does an SSL certificate contain?
• Who issues these certificates?
• How does a client verify them?
• If TLS already verifies certificates, why do some applications implement Certificate Pinning?

In this article, we’ll answer these questions step by step and understand how modern applications establish trust before exchanging encrypted data.

1️⃣. Why Do We Need Encryption?

Whenever data travels across the internet, it passes through multiple networks and devices before reaching its destination. If this information is sent as plain text, anyone intercepting the traffic can read or modify it.

Key Takeaway: Encryption protects data while it is traveling across the internet.

2️⃣. Types of Encryption

Modern secure communication relies on two types of encryption.

Symmetric Encryption

Symmetric encryption uses one secret key for both encryption and decryption.

Plain Text
     │
Encrypt (Secret Key)
     │
Cipher Text
     │
Decrypt (Same Secret Key)
     │
Plain Text

Popular algorithms include:

• AES

Advantages

• Extremely fast
• Efficient for large amounts of data
• Low computational overhead

Limitation

Both parties must already possess the same secret key.

But how can they securely exchange that key over the internet?

This problem leads us to asymmetric encryption.

Asymmetric Encryption

Asymmetric encryption uses two mathematically related keys.

• Public Key → Can be shared openly
• Private Key → Must remain secret

Data encrypted using the public key can only be decrypted using the corresponding private key.

Popular algorithms include:

• RSA
• ECC (Elliptic Curve Cryptography)

3️⃣. Hybrid Encryption (How TLS Actually Works)

TLS combines both encryption techniques.

1. Asymmetric encryption securely establishes a shared session key.
2. Symmetric encryption uses that session key to encrypt all application data.

This approach provides the best of both worlds:

• Secure key exchange
• High-performance communication

After the initial handshake, algorithms like AES encrypt every request because they’re significantly faster than RSA or ECC.

Key Takeaway: TLS uses asymmetric encryption for trust and symmetric encryption for speed.

4️⃣. SSL vs TLS

🌐What is SSL?

SSL (Secure Sockets Layer) was the original protocol for securing internet communication. Over time, several vulnerabilities were discovered, making SSL insecure.

TLS (Transport Layer Security) was introduced as its successor with stronger encryption algorithms, improved authentication, and better security mechanisms.

Although SSL is obsolete, the term “SSL Certificate” is still widely used today, even though modern websites actually use TLS.

SSL TLS Older protocol Modern protocol Vulnerable Secure Deprecated Actively maintained SSL 2.0 / 3.0 TLS 1.2 / TLS 1.3

🤝TLS Handshake

Before encrypted communication begins, the client and server perform a TLS Handshake.

ClientHello
      ↓
ServerHello
      ↓
Certificate
      ↓
Certificate Verification
      ↓
Session Key Exchange
      ↓
Secure Communication

1. ClientHello

The client initiates the connection by sending:

• Supported TLS versions
• Supported cipher suites
• Random value

2. ServerHello

The server responds with:

• Selected TLS version
• Cipher suite
• Another random value

3. Certificate

The server sends its TLS certificate containing its public key and identity.

4. Certificate Verification

The client verifies:

• Certificate Authority signature
• Domain name
• Expiration date
• Trust chain
• Revocation status

If verification fails, the connection is immediately rejected.

5. Session Key Exchange

Using asymmetric cryptography, both parties establish a shared session key.

6. Secure Communication

Once the handshake completes successfully, all subsequent communication is encrypted using fast symmetric encryption such as AES.

5️⃣. Certificate Authority & SSL Certificate

🏛️ What is a Certificate Authority?

A Certificate Authority (CA) is a trusted organization responsible for issuing and digitally signing certificates.

Get Akash Senthil’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Browsers and operating systems maintain a list of trusted Root CAs. If a certificate is signed by one of these trusted authorities, the client can verify its authenticity.

Popular Certificate Authorities include:

• DigiCert
• GlobalSign
• Sectigo
• Let’s Encrypt

📜 What is an SSL/TLS Certificate?

Think of a certificate as a digital identity card for a server.

It proves:

• Who the server is
• Which domain it belongs to
• Its public key
• Which CA verified it

What Does a Certificate Contain?

6️⃣. Certificate Verification

Receiving a certificate doesn’t automatically mean it’s trustworthy.

The client performs several checks:

• Is it signed by a trusted CA?
• Has it expired?
• Does the domain match?
• Has the certificate been revoked?
• Does the trust chain lead to a trusted Root CA?

Only after every verification succeeds does the TLS handshake continue.

Key Takeaway: TLS establishes trust before exchanging encrypted data.

7️⃣. 📌Certificate Pinning

If TLS already verifies certificates, why do some applications implement Certificate Pinning?

TLS trusts any certificate issued by a trusted CA. While this is sufficient for most applications, some high-security apps require stricter validation.

Certificate Pinning allows an application to trust only a specific certificate or public key, even if another certificate is technically valid.

The process works like this:

1. Server sends its certificate.
2. Client generates the certificate fingerprint locally.
3. Client compares it with the fingerprint embedded inside the application.
4. If they match, the connection continues.
5. Otherwise, the connection is rejected immediately.

It’s important to note that the server never sends the fingerprint separately. The client calculates it from the received certificate and performs the comparison locally.

Key Takeaway: Certificate Pinning adds an extra layer of trust beyond standard TLS verification.

8️⃣. MITM Attack

Without Certificate Pinning

Client
   │
   ▼
Attacker
   │
   ▼
Server

In a Man-in-the-Middle (MITM) attack, an attacker positions themselves between the client and the server.

If the client accepts the attacker’s certificate as valid, the attacker can intercept, inspect, or modify traffic while both parties believe they’re communicating securely.

With Certificate Pinning

Client
      │
      ▼
Certificate Received
      │
      ▼
Generate Fingerprint
      │
      ▼
Compare with Stored Fingerprint
      │
 ┌────┴────┐
 │         │
Match   No Match
 │         │
Allow   Reject

With Certificate Pinning enabled, the application compares the received certificate against its pinned fingerprint.

Even if an attacker presents a certificate that would normally pass TLS validation, the fingerprint won’t match, causing the connection to be rejected immediately.

9️⃣.❓Common Misconceptions

❌ HTTPS makes applications impossible to hack.

✅ HTTPS only protects data in transit.

❌ SSL and TLS are the same.

✅ TLS is the secure successor to SSL.

❌ RSA encrypts every network request.

✅ RSA/ECC establish trust; AES encrypts the actual data.

❌ Certificate Pinning encrypts data.

✅ It verifies server identity beyond standard TLS checks.

❌ Certificates are secret.

✅ Certificates are public; the private key must remain secret.

❌ The server sends the fingerprint.

✅ The client generates the fingerprint locally from the received certificate.

❌ Certificate Pinning prevents every attack.

✅ It mainly protects against certificate-related MITM attacks and should be part of a broader security strategy.

🔟.🎯Recap

✍️ Akash Senthil

Thank you for reading “SSL, TLS & Certificate Pinning”! 🚀

I hope this article helped you build a clear mental model of how secure communication works — from encryption and TLS handshakes to certificates, Certificate Authorities, and Certificate Pinning.

If you found it valuable, consider clapping 👏, following 🙌, and sharing it with fellow developers. I regularly write about Flutter, mobile security, software architecture, CI/CD, performance optimization, and practical engineering concepts explained through simple visuals and real-world examples.

You can also connect with me on LinkedIn to stay updated on future articles, open-source projects, conference talks, and Flutter community events.

Happy Coding & Stay Secure! 🔐🚀