3 ms·
This is true. This is an actual case where pinning is a good idea, but this sort of pinning can and should happen in the application code or config, by restrict
by skywhopper 9y ago
This is true. This is an actual case where pinning is a good idea, but this sort of pinning can and should happen in the application code or config, by restricting which CAs are trusted for a particular transaction. There's no need for a generic HTTP header for this situation. Set your TLS negotiation requirements in your app.