5 ms·
Years ago I read a blog that taught the series of steps needed to perform GNUTLS certificate pinning for Emacs use. At the time, it seemed like a convenient way
by Mediterraneo10 6y ago
Years ago I read a blog that taught the series of steps needed to perform GNUTLS certificate pinning for Emacs use. At the time, it seemed like a convenient way to boost security. After all, services were only renewing their certificates every 2–3 years, so once you set up your configuration, you wouldn't have to change it for a long time.
But then Lets Encrypt came along and was widely adopted. LE thinks that it is best that certificates expire after only a few weeks. So, if you have pinned a lot of certificates, you start to feel that it is too much work to manage that configuration, you constantly have to update it.
- elithrar 6y agoYou shouldn’t be pinning to your leaf certs, which is the only reason LE certs would be a problem here.
- kingosticks 6y agoPossibly stupid question here (this is not my domain), but what is the alternative to pinning the client to use your leaf certs? If it's pinning to your root cert, then isn't that much more of a pain if/when you need to revoke what the client is using? Or is the correct alternative to pin "to one or multiple rsa public keys" as mentioned in the sibling comment?
- elithrar 6y agoLate reply, but: if you really must pin (and you probably shouldn’t), pin to public keys, not the certs in the chain.
- kingosticks 6y agoThank you!
- jtdressel 6y agoInstead of pinning the cert, you can pin to one or multiple rsa public keys. Then you can use those keys when you generate signing requests (CSR) from lets encrypt.