If you pin to a root CA you&#x27;re vulnerable to MITM if an intermediate CA that has the root in its chain of trust is compromised. Because that compromised CA would be able to sign a cert for an arbitrary domain while still satisfying your pinning directives.<p>By pinning to a public key you&#x27;re saying &quot;is this public key in this certificate&#x27;s chain of trust?&quot;. Pinning to a root you have the most flexibility but the least amount of protection against MITM.