3 ms·
Server software might be able to help with some of the foot-gunning mentioned in Scott Helme's writeup. For example, web servers that were just configured to do
by Strilanc 10y ago
Server software might be able to help with some of the foot-gunning mentioned in Scott Helme's writeup. For example, web servers that were just configured to do cert pinning for the first time could default to giving a 5-hour grace period where the max-age was clamped below a day, followed by a 2-day grace period where the max-age was clamped below a week. Problems are likely to show up immediately, so starting with a low max-age makes sense.
This wouldn't help with malicious scenarios though; attackers would just disable the grace period.
- zrm 10y agoYou could do that on the client side too though. Have the clients refuse to long-term pin anything until they've seen it multiple times over multiple days.
- Strilanc 10y agoDoing it client-side defeats the purpose of certificate pinning. Three years after you rolled out pinning, new users would still be using max ages that were clamped too low.