<!--
{
  "availability" : [
    "iOS: 14.0.0 -",
    "iPadOS: 14.0.0 -",
    "macOS: 11.0.0 -",
    "visionOS: 1.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "BundleResources",
  "identifier" : "/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSPinnedDomains",
  "metadataVersion" : "0.1.0",
  "role" : "Property List Key",
  "symbol" : {
    "kind" : "Property List Key",
    "modules" : [
      "Bundle Resources"
    ],
    "preciseIdentifier" : "plist:Information_Property_List.NSAppTransportSecurity.NSPinnedDomains"
  },
  "title" : "NSPinnedDomains"
}
-->

# NSPinnedDomains

A collection of certificates that App Transport Security expects when connecting to named domains.

## Discussion

The value for this optional key is a dictionary with keys that specify the domain names for which you want to set the expected certificates. The value for each domain name key is another dictionary that configures the expected certificates for that domain.

```console
NSPinnedDomains : Dictionary {
    <domain-name-string> : Dictionary {
        NSIncludesSubdomains : Boolean
        NSPinnedCAIdentities : Array
        NSPinnedLeafIdentities : Array
    }
}
```

For any domain that you specify, you must include one or more expected Certificate Authority (CA) or sub-CA certificates as the value for the [`NSPinnedCAIdentities`](/documentation/BundleResources/Information-Property-List/NSPinnedCAIdentities) key, one or more expected leaf certificates as the value for the [`NSPinnedLeafIdentities`](/documentation/BundleResources/Information-Property-List/NSPinnedLeafIdentities) key, or both. If you specify both, App Transport Security (ATS) requires a match in each category.

To specify a domain name string, follow the rules for domain names given in [`NSExceptionDomains`](/documentation/BundleResources/Information-Property-List/NSAppTransportSecurity/NSExceptionDomains). You can also extend the pinning to cover subdomains by setting the value for the [`NSIncludesSubdomains`](/documentation/BundleResources/Information-Property-List/NSIncludesSubdomains) key to `YES`.

Pinning a certificate for a given domain has no impact on other security requirements or configuration. For example, pinning a CA certificate doesn’t change the way the system evaluates that certificate’s suitability as an anchor certificate. For information about securing network connections, see <doc://com.apple.documentation/documentation/Security/preventing-insecure-network-connections>.

## Topics

### Subdomains

[`NSIncludesSubdomains`](/documentation/BundleResources/Information-Property-List/NSIncludesSubdomains)

A Boolean value that indicates whether to extend the configuration to subdomains of the given domain.

### Identities

[`NSPinnedCAIdentities`](/documentation/BundleResources/Information-Property-List/NSPinnedCAIdentities)

A list of allowed Certificate Authority certificates for a given domain name.

[`NSPinnedLeafIdentities`](/documentation/BundleResources/Information-Property-List/NSPinnedLeafIdentities)

A list of allowed leaf certificates for a given domain name.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)