3 ms·
You can pin any certs via HPKP, including self-signed ones. The only security feature EV certs have over regular ones right now is the use of certificate trans
by jnbiche 11y ago
You can pin any certs via HPKP, including self-signed ones.
The only security feature EV certs have over regular ones right now is the use of certificate transparency, but that should be extended to non-EV certs within 1-2 years.
- aianus 11y agoNo, the security feature is that if you only pin, say, Verisign EV root and Digicert EV root then an attacker would have to pass EV validation at those vendors. Which is much more difficult to do than to get any cert anywhere. You could pin your own cert, but that makes it difficult to rotate keys in a heartbleed type situation.
- vtlynch 11y agoWow, I never thought of that before! Though it would not protect from factoring because most EV roots are the same key length/hash. For anyone else reading, this works because the root programs give authority to issue EV certs separately from other certs. To keep the authority separate (most, perhaps all) CAs use separate roots for EVs.