4 ms·
Which is by itself broken. Large websites exchange certificates very often, rendering pinning useless. Unless you are talking not about pinning but about pinnin
by exo762 11y ago
Which is by itself broken. Large websites exchange certificates very often, rendering pinning useless. Unless you are talking not about pinning but about pinning by external actor, such as Google. And that is just moving your own security from hands of CA to hands of Google.
- icebraining 11y agoYou can pin a certificate higher in the chain, like the root cert of your CA. That way, you can still rotate your own cert, but an attacker couldn't just install a new root cert in the machine, they would have to get a cert from the same CA as your own.
- viraptor 11y agoDo any of the publicly available CAs provide a guarantee that you can pin them? I remember there was at least one case of someone pinning a CA and making the news because the page could not load anymore.
- icebraining 11y agoI can't say I know, but I don't think they can simply replace them at will, otherwise wouldn't existing certs just stop working?
- viraptor 11y agoThe intermediates can be replaced without issues, as long as they link to the same root certificates. That's the standard way to rotate them when they expire, or get compromised.
- icebraining 11y agoAh, yes, but my suggestion was to pin the root.
- iancarroll 11y agoCAs will not arbitrarily throw out their root certificates (they're quite expensive and valuable), so you'll be fine pinning to a root. I'd advise against it when you use OV or EV certificates though, as it'd allow for a DV certificate to still work.
- Buge 11y agoWhen are you talking about them being replaced? Because I thought website certificates embed the signature of the signer (the intermediate), so if the intermediate is revoked, my website's certificate won't work anymore. If that's the case I should be fairly safe pinning the intermediate for as long as my website certificate is valid.
- goes_to_11 11y agoYou can pin (multiple) private keys. Usually, you don't have to change your private key when getting a new certificate (for example, with Lets Encrypt). If you do want to change private keys regularly, generate them beforehand and pin them.