I recently worked on an mobile app and established public key pinning for connections with my server. Connections from the client app may be made to various subdomains of the main server domain.
Is checking for proper domain or subdomain associated with the public certificate in the server authentication process increasing security? I mean - if I'm anyway checking for the public key, is it necessary to check also for domain and subdomain? If so, why? What can I do to perform domain/subdomain check while not knowing all possible subdomains at time of deploying app to the production?