5 ms·
But... What if a new user arrives and doesn't have your pinned CA? Your model would require to always have a trusted CA and if you always have them why trouble
by hdhzy 9y ago
But... What if a new user arrives and doesn't have your pinned CA? Your model would require to always have a trusted CA and if you always have them why trouble oneself with pinning custom one?
- daurnimator 9y agoThe idea is that the cert must be signed by my own CA. But may also be signed by another CA. Meaning that after the first visit, a user is protected from a rogue CA issuing a cert for my site.
- hdhzy 9y agoUnfortunately X 509 doesn't support multiple signatures. But your model is very similar to HPKP, just the details on what exactly is signed are different.
- daurnimator 9y agoThanks: that was the piece of the puzzle I was missing. I was confused by how people describe cross-signing as an intermediate cert being signed by two CAs. On further research, it's done via having two intermediate certs. But effectively: they accomplish cross-signing by having two different roots for the same leaf cert: we should be able to do that with 1 CA root, and 1 site-admin root (specified via some HPKP-like mechanism) On the other hand, perhaps the limitation of one cert should be removed somehow? e.g. via an extension: old user-agents would just see the first signing cert, but others would see all of them?