---
schema_version: "1"
id: 4d4d72f93b3831f275136742016b479c992e0e6792a0319a80d3bc4c633fc11e
title: Configure Authentication Server Certificate Pin
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mobile_security_mam_server_cert_pin.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mobile_security_mam_server_cert_pin.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 34a0911b8368e6a5e799aefb11af9c5ccefb861c45e6c97b7b189a96b84120fc
description: Provide domain name and certificate fingerprint to configure authentication server certificate pin.
products:
  - Security
  - Mobile App
  - Cross Cloud
release: "264"
---
# Configure Authentication Server Certificate Pin

Provide domain name and certificate fingerprint to configure authentication server certificate pin.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d947e33">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d947e33 ">To create and modify Enhanced Mobile App Security settings:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d947e33 ">
              <p>Manage Enhanced Mobile App Security</p>
              <p>AND</p>
              <p style="margin-bottom:0;">Modify Metadata</p>
            </td>

          </tr>
        </tbody>
      </table>

1. In the Mobile Security Setup UI, enable **Authentication Server Certificate Pinning**.
    
    ![Authentication Server Certificate Pin](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-mobile_security-264-0-0-production-enus/aa5de880-f40d-4478-acb7-729eee2b5d4e/mobile_security/images/mobile_security_auth_server_cert_pin.png)
2. Enter the domain name for the server that you want to pin the certificate for in the **Domain Name** field. For example, `https://login.salesforce.com`.
3. For the **Certificate Fingerprint**, you have two options to obtain the value.
    
    You can obtain the Certificate Fingerprint value from your org’s internal team that owns the certificate.
    
    You can use a third-party application such as [www.ssllabs.com](https://www.ssllabs.com/) to obtain the Certificate Fingerprint value.
    
    ![Certificate Fingerpring Value](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-mobile_security-264-0-0-production-enus/aa5de880-f40d-4478-acb7-729eee2b5d4e/mobile_security/images/mobile_security_auth_server_cert_pin_ssl.png)
4. Copy and paste the value into the **Certificate Fingerprint** field.
    
    ![Certificate Fingerprint](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-mobile_security-264-0-0-production-enus/aa5de880-f40d-4478-acb7-729eee2b5d4e/mobile_security/images/mobile_security_auth_server_cert_pin_hash.png)
5. Click **Save**.

Here are a few things to keep in mind about authentication server certificate pins.

- The test of the server certificate happens when the user logs in. This policy doesn’t replace the Man-in-the-Middle security policy.
- The certificate is set after the user logs in for the first time, and is enforced for subsequent logins on that server. If the policy is updated or removed, then the updated policy is picked up by the app the next time the user logs in.
- The authentication server pins aren’t enforced if the user is using advanced authentication in Safari.
- If the pinned server certificate is rotated, but the app isn’t updated, then the user can’t log in because of the mismatched pins. A workaround is to ask the user to reinstall the app to obtain the new certificate pin value.
- It’s recommended that you use the pin of the intermediate certificate, since that provides a good balance between how frequently it expires and security value.