4 ms·
Except that HPKP is being deprecated by Chrome (https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ?hn https://groups.google
by dagenix 8y ago
Except that HPKP is being deprecated by Chrome (https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ?hn https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...). And I'd suspect other browsers will follow.
- sandij 8y agoWhen pinning CAs instead of certificates, you’d use CAA instead of HPKP.
- BillinghamJ 8y agoThat wouldn’t work, as there’s no differentiator between EV and non-EV
- toast0 8y agoCAA isn't restricting acceptance of certs, it's restricting issuance, assuming the attempted issuer is compliant, competent, and that your domain didn't get hijacked.
- BillinghamJ 8y agoI don’t mean website pinning. I mean eg apps etc