3 ms·
You shouldn’t be pinning to your leaf certs, which is the only reason LE certs would be a problem here.
by elithrar 6y ago
You shouldn’t be pinning to your leaf certs, which is the only reason LE certs would be a problem here.
- kingosticks 6y agoPossibly stupid question here (this is not my domain), but what is the alternative to pinning the client to use your leaf certs? If it's pinning to your root cert, then isn't that much more of a pain if/when you need to revoke what the client is using? Or is the correct alternative to pin "to one or multiple rsa public keys" as mentioned in the sibling comment?
- elithrar 6y agoLate reply, but: if you really must pin (and you probably shouldn’t), pin to public keys, not the certs in the chain.
- kingosticks 6y agoThank you!