From 3b9e0e759d7a46318a90bd7f2026679dcbf805b0 Mon Sep 17 00:00:00 2001
From: webbrain-one <295484252+webbrain-one@users.noreply.github.com>
Date: Tue, 18 Aug 2026 18:35:18 +0300
Subject: [PATCH] Add certificate pin config file support

Add certificate pin configuration and JSON schema for runtime pin
updates, while retaining hardcoded defaults as a fallback.
---
 config/certificate_pins.json        | 13 +++++++++++++
 config/certificate_pins.schema.json | 27 +++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 config/certificate_pins.json
 create mode 100644 config/certificate_pins.schema.json

diff --git a/config/certificate_pins.json b/config/certificate_pins.json
new file mode 100644
index 0000000..0e72204
--- /dev/null
+++ b/config/certificate_pins.json
@@ -0,0 +1,13 @@
+{
+  "$schema": "./certificate_pins.schema.json",
+  "pins": {
+    "api.pinnaclemm.exchange": [
+      "REPLACE_WITH_SPKI_SHA256_BASE64_PIN_01",
+      "REPLACE_WITH_SPKI_SHA256_BASE64_PIN_02"
+    ],
+    "ws.pinnaclemm.exchange": [
+      "REPLACE_WITH_SPKI_SHA256_BASE64_PIN_03",
+      "REPLACE_WITH_SPKI_SHA256_BASE64_PIN_04"
+    ]
+  }
+}
diff --git a/config/certificate_pins.schema.json b/config/certificate_pins.schema.json
new file mode 100644
index 0000000..0900e62
--- /dev/null
+++ b/config/certificate_pins.schema.json
@@ -0,0 +1,27 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Certificate Pins Configuration",
+  "description": "Runtime certificate pins. Hosts not listed here fall back to the built-in default pins.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "pins": {
+      "type": "object",
+      "description": "Map of host (or hostname pattern) to a list of certificate pins.",
+      "minProperties": 1,
+      "additionalProperties": {
+        "type": "array",
+        "minItems": 1,
+        "items": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Certificate pin (SPKI SHA-256 digest, base64-encoded)."
+        }
+      }
+    }
+  },
+  "required": ["pins"]
+}