3 ms·
You can pin to any of the public keys in your certificate chain, so that's the root cert, intermediate certs, or your own cert. Most deployments currently pin
by pfg 11y ago
You can pin to any of the public keys in your certificate chain, so that's the root cert, intermediate certs, or your own cert.
Most deployments currently pin to a main and backup CA. This is because HPKP makes it fairly easy to essentially brick your domain (Think: Heartbleed and a lost backup key. Say goodbye to your domain!). It's possible, but you better know what you're doing.
- rsync 11y agoWow. So there's no way to simply say "here is the public key that I expect to see for this website, and alert me if it's different" ? Isn't that the simplest thing with the most utility ? What am I missing here ?
- pfg 11y ago"any of the public keys in your certificate chain" includes your own certificate, so yes, that's possible. However, if your main and backup key is lost or compromised, you have essentially bricked your domain. That's why most real-life deployments pin to two CAs instead (since CAs are generally better at managing keys).