# Certificate Pinning Bypass

> Detects network configurations and code patterns that disable or bypass certificate pinning, weakening TLS security.

- Skill: `zakirkun/certificate-pinning-bypass` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/certificate-pinning-bypass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/certificate-pinning-bypass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/certificate-pinning-bypass

---


# Certificate Pinning Bypass

## Overview
Certificate pinning enhances TLS by restricting which certificates are trusted for specific connections. Bypassing or disabling pinning allows MITM attacks even on apps that previously validated certificates.

Common bypass methods:
- Setting `checkValidity = false` in pinning configuration
- Using a catch-all TrustManager
- OkHttp pinning disabled
- Node.js `NODE_TLS_REJECT_UNAUTHORIZED=0`

## Remediation
- Implement pinning using the native OS keystore or a dedicated library
- Monitor for pinning bypass attempts
- Test pinning resistance against tools like Frida, Objection