3 ms·

Wow. So there's no way to simply say "here is the public key that I expect to see for this website, and alert me if it's different" ? Isn't that the simplest

by rsync 11y ago

Wow. So there's no way to simply say "here is the public key that I expect to see for this website, and alert me if it's different" ? Isn't that the simplest thing with the most utility ? What am I missing here ?

pfg 11y ago
"any of the public keys in your certificate chain" includes your own certificate, so yes, that's possible. However, if your main and backup key is lost or compromised, you have essentially bricked your domain. That's why most real-life deployments pin to two CAs instead (since CAs are generally better at managing keys).