A penetration tester is testing a new version of a mobile application in a sandbox environment. To intercept and decrypt the traffic between the application and the external API, the tester has…

If TCP port 443 were not open, the connection would fail at the network layer, typically with a connection timed out or refused error, not a certificate mismatch.

Whether the API server uses SSL or TLS (TLS is the modern standard) does not directly cause a certificate mismatch error when a valid (from the OS's perspective) root CA is installed; the issue typically lies with the trust chain or certificate validation logic.

An outdated application version is unlikely to be the primary cause of a specific certificate mismatch error when a custom root CA is properly installed, unless that specific version had a known, peculiar trust issue unrelated to standard pinning.

Certificate pinning is a security mechanism where an application is hardcoded to trust only a specific certificate or public key, or a specific set of certificates/public keys. Even if a custom root CA is installed in the device's trusted store, an application with pinning will reject any certificate that does not match its internal whitelist, leading to a mismatch error during a Man-in-the-Middle attempt.