The client stores the SHA-256 hash of the server’s public key (SPKI) and rejects any other key, even if a trusted CA signed it. It limits the damage of a wrongly issued certificate but makes rotation harder, so pin carefully and keep a backup pin.
Certificate pinning
Accepting only a server whose certificate or public key matches a hash the client already knows.