Certificate pinning usually (ex: Chrome) is implemented with an exception to allow a company administrator to install a new root CA cert on the device and MITM connections. Does iMessage not allow this?
` if (!is_issued_by_known_root || !HasPublicKeyPins(host, sni_available)) { return true; } `
https://code.google.com/p/chromium/codesearch#chromium/src/n...