4 ms·
HPKP is based on the public key, not the certificate. You can continue to use a certificate with the same public key across renewals. You could even switch to a
by pfg 9y ago
HPKP is based on the public key, not the certificate. You can continue to use a certificate with the same public key across renewals. You could even switch to a different CA if you pin to the key of your server (end-entity) certificate.
That said, most experts recommend pinning to a number of CA roots or intermediates instead of pinning solely to keys under your control. (Backup pins to keys under your control are still recommended.)