2 ms·
No, the security feature is that if you only pin, say, Verisign EV root and Digicert EV root then an attacker would have to pass EV validation at those vendors.
by aianus 11y ago
No, the security feature is that if you only pin, say, Verisign EV root and Digicert EV root then an attacker would have to pass EV validation at those vendors. Which is much more difficult to do than to get any cert anywhere.
You could pin your own cert, but that makes it difficult to rotate keys in a heartbleed type situation.
- vtlynch 11y agoWow, I never thought of that before! Though it would not protect from factoring because most EV roots are the same key length/hash. For anyone else reading, this works because the root programs give authority to issue EV certs separately from other certs. To keep the authority separate (most, perhaps all) CAs use separate roots for EVs.