TLS encrypts data between clients and servers in Azure Database for PostgreSQL, with server certificates issued by trusted CAs. Certificate pinning is a client-side security method restricting trust to a specific certificate, not the default trust store. The server cannot detect if pinning is configured on the client, only observing TLS handshake success or failure. Pinning, though historically used for man-in-the-middle protection, introduces operational fragility, especially during certificate rotations. When server certificates or CAs change, pinned clients experience connection failures. Instead, a CA-based trust model is recommended, trusting root CAs rather than individual certificates. Clients should use standard TLS validation against Azure-documented root CAs and maintain a flexible, up-to-date trust store. PostgreSQL configurations like sslmode=verify-ca or sslmode=verify-full are preferred, as they validate against trusted CAs without implying pinning. During CA rotations, clients should add new root CAs while retaining old ones until the transition is complete. This combined CA approach ensures uninterrupted validation, allowing applications to remain resilient to certificate changes.