4 ms·
Sounds like there should be a setup that works something like this: Some time before expiry, A gets a new cert and advertises that cert, while still using the o
by myrion 10y ago
Sounds like there should be a setup that works something like this:
Some time before expiry, A gets a new cert and advertises that cert, while still using the old cert to secure the connection. When A makes the switch, B already has the new cert, obtained over a secured connection.
I'm not sure how the "hey, I'll switch to this cert soon" bit should be done, though.
- marcosdumay 10y agoIt's enough to just sign the new public key with the old secret key, and send that at some place in the new certificate. (It's also kind of worthless. Since people normally change their secret because they have some reason to believe it's compromised, whoever has the old key can also create the same certificate. In other words, it's only useful on the use cases where pinning already fails...)