certificate pinning

Certificate pinning is a security technique that associates a host with its expected X.509 certificate or public key, helping to prevent man-in-the-middle (MITM) attacks. On Windows, certificate pinning is relevant when configuring on-premises identity providers like Duo Access Gateway (DAG), where administrators must plan for certificate authority (CA) bundle updates and migrations to maintain secure SAML 2.0 SSO. Proper pinning ensures that only trusted certificates are accepted during TLS handshakes, reducing the risk of interception or code injection. Windows administrators should understand pinning as part of end-to-end communication security, especially when integrating third-party authentication services.