# Android/OkHttp: javax.net.ssl.SSLPeerUnverifiedException: Certificate pinning failure! Peer certificate chain: sha256/... Pinned certificates for api.example.com

**Code:** `Certificate pinning failure!` · **Category:** SSL / TLS · **Seen on:** SSL, Android

The app's pinned certificate/public-key hash does not match the one the server presented, so OkHttp blocked the request.

## Meaning

Pinning ties the app to specific keys. After a certificate renewal with a new key (or a CDN/proxy change) the old pin fails. Pin to the intermediate or use backup pins, rotate pins before expiry via an app update, and never test through intercepting proxies with pinning enabled.

## Common causes

- Certificate rotated with a new key
- CDN/proxy changed the presented chain
- Intercepting proxy (Charles/mitmproxy) while pinned
- Wrong hash or host in CertificatePinner
- No backup pin configured

## Quick fix

1. Update the pin set to include current and next keys
2. Pin intermediate CA public keys for resilience
3. Print the actual chain hashes from the exception and compare

## Detailed fix by platform

### Android

1. The exception lists `sha256/...` for each presented cert; copy the right one into `CertificatePinner.Builder().add("api.example.com", "sha256/...")`

## How to diagnose

1. **Pins** — Match presented hashes?
2. **Rotation** — Key changed?
3. **Proxy** — Intercepting?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/okhttp-certificate-pinning-failure)