4 ms·
Because the browser (or the user) has no way of knowing if the certificate changed for a good reason. Certificate pinning tries to tackle this at the CA level b
by pepr 10y ago
Because the browser (or the user) has no way of knowing if the certificate changed for a good reason. Certificate pinning tries to tackle this at the CA level but it's not perfect (in a nutshell, browsers know that google.com can be signed only by a certain small subset of CAs).
- algesten 10y agoThe effort to prove a certificate is being changed for a good reason should be with the site owner, so I perhaps the standard could build in some sort of sign-by-previous-cert combined with mandatory information fields. The certificate pinning of CA is not that useful. So google rotate a lot of certs, but I bet 95% of the internet use one cert for one server until it expires. Google could fall in in line.