3 ms·

Certificate pinning means it's a hell of a lot more than just "buying a new cert".

• tyingq 10y ago
  Ah, yes. If you didn't have a backup cert from another provider and missed your 60 day window. But what was your plan for any other incident that required revocation? I assume anyone turning on pinning hand wrings over it for a while first.
  • eridius 10y ago
    You can pin to the CA intermediate cert, which means revocation isn't a problem as long as you keep the same CA.
• 0x0 10y ago
  Finally, there's some value in, and a reason to, picking a responsible CA instead of the cheapest or most convenient one!
  • pas 10y ago
    That's the problem, a lot of Big Corps thought Symantec is okay, because it's (was?) expensive as fuck and it has a nice long history! (So reputation. They're on NASDAQ, they must be okay!) But that's just business as usual. You never know when your vendor goes rouge. And really Big Corps should have plans for these events.