Certificate Pinning is a security technique where an application is "hardcoded" to trust only one specific digital certificate or public key. In a standard secure connection (SSL/TLS), an application trusts any certificate issued by a "Trusted Root Authority" (like DigiCert or Let’s Encrypt). With Pinning, the application ignores the system’s list of trusted authorities and looks for a specific, "pinned" certificate. If it sees any other certificate, even one that is technically valid, it will terminate the connection immediately.
To monitor certificate pinned apps, Teramind uses different techniques depending on the application:
Outlook Desktop (MAPI Integration)
Microsoft Outlook uses certificate pinning to secure communication with Exchange and Microsoft 365 servers. To monitor emails and attachments without triggering a security block, Teramind uses the MAPI (Messaging Application Programming Interface).
Electron-based Apps (JavaScript Injection)
Many modern business apps, such as AirCall, RingCentral, 8x8, Slack, etc. are built using the Electron framework. Teramind uses a JavaScript injection/proxy method to monitor these apps.
Handling Invalid Certificates
If an app uses a self-signed or non-standard certificate that causes errors, you can add it to the Monitor these hosts with invalid certificates field in the Website monitoring settings to force decryption, though this is generally recommended only as a last resort.