Don't worry. If I'm following the code correctly, then the definition of "the certificate changed" is "either the issuer name, notBefore, or notAfter fields cha

Don't worry. If I'm following the code correctly, then the definition of "the certificate changed" is "either the issuer name, notBefore, or notAfter fields change." Unless you are Google, Cloudfare [1], or the issuer is Let's Encrypt, in which case that check isn't bothered with as those sites update too frequently. No need to worry about, let's say, the public key possibly different. I'm not sure how much of the rest of the certificate process is being done (e.g., making sure that the cryptographic signature is valid), since I'm not savvy on OpenSSL's APIs to know what you do yourself and what OpenSSL does for you. Even for a TOFU implementation of SSL, this repository is amazingly bad. [1] Yes, those site names are hardcoded. By server name. So anyone could MITM google here. Or cdnjs.cloudfare.com.