3 ms·

Does this mean we're going to see a bunch of services fail due to poor certificate pinning implementations?

• judge2020 6y ago
  Not certificate pinning, but a lot of devices (particularly old Android devices) no longer work since their CA store doesn't have the Let's Encrypt Root CA that LE themselves run.
• tialaramex 6y ago
  This probably doesn't, but in principle other related charges could. In the past few days the new intermediate R3 went live, so if you have systems which pin Let's Encrypt Authority X3 (a bad idea but possible) those break when you next renew. The tricky part of pinning is coming up with a good policy for what to pin. As so often the technology is easy, the policy is hard.
  • olliej 6y ago
    I've seen code that pins entire cert chains, up to and including a specific root CA. Sometimes not even the public key but memcmp with the root's entire public certificate