25 ms·
When pinning CAs instead of certificates, you’d use CAA instead of HPKP.
by sandij 8y ago
When pinning CAs instead of certificates, you’d use CAA instead of HPKP.
- BillinghamJ 8y agoThat wouldn’t work, as there’s no differentiator between EV and non-EV
- toast0 8y agoCAA isn't restricting acceptance of certs, it's restricting issuance, assuming the attempted issuer is compliant, competent, and that your domain didn't get hijacked.