Investigating 9 users receiving forged TLS certificates through report-only certificate pinning

Short summary

A team discovered 9 users receiving intercepted TLS certificates on their app, initially suspecting a bug but finding that report-only certificate pinning correctly flagged man-in-the-middle interception on those users' networks. An AI agent initially misdiagnosed the issue as benign network proxies, but the author pushed back and discovered the probe code validated chains against the OS trust store before pin comparison, meaning these were forged certificates. The investigation reveals the importance of understanding your own probe logic before acting on AI-suggested conclusions.

• •Certificate pinning in report-only mode caught 9 users receiving forged TLS certificates
• •AI agent initially misdiagnosed the issue; author's questioning led to correct understanding
• •Probe validates trust store first, then compares pins — mismatch meant interception, not a pin issue

Generated with AI, which can make mistakes.