4 ms·
You could do that on the client side too though. Have the clients refuse to long-term pin anything until they've seen it multiple times over multiple days.
by zrm 10y ago
You could do that on the client side too though. Have the clients refuse to long-term pin anything until they've seen it multiple times over multiple days.
- Strilanc 10y agoDoing it client-side defeats the purpose of certificate pinning. Three years after you rolled out pinning, new users would still be using max ages that were clamped too low.