miji.beCertificate pinning is a security technique in which an application pins the TLS certificate (or public key) of the server it communicates with in advance and rejects the connection if the certificate presented at connection time does not match the pinned value. It is used as a countermeasure against man-in-the-middle attacks (MITM) that use fake certificates issued by rogue certificate authorities.
As implementation examples in mobile apps, on iOS you specify the hash of the certificate's public key in a URLSession delegate method, and on Android in Network Security Config. In a short URL app, if a MITM attack occurs while the redirect destination is being retrieved, there is a risk that users will be led to a malicious site.
HTTP Public Key Pinning (HPKP) was once standardized for web browsers, but Google has announced that it will remove HPKP in Chrome 72, citing low usage and risks such as denial of service. Certificate Transparency (CT) is a mechanism that records issued certificates in public logs so that improper issuance can be detected.
An operational challenge of certificate pinning is that an app update is required when certificates are rotated. Setting backup pins or pinning at the intermediate certificate level can lessen the impact of rotation.
For short URL services, another approach is to combine certificate pinning to protect API communication with CT log monitoring to detect improperly issued certificates.