3 ms·
I'd recommend pinning (your) keys because knowing cert SHAs ahead of time means you need the certificates themselves and in a nasty situation the CAs you relied
by tialaramex 3y ago
I'd recommend pinning (your) keys because knowing cert SHAs ahead of time means you need the certificates themselves and in a nasty situation the CAs you relied on to issue those certs may be out of the picture, if you're pinning a key that's fine, CA #5 will cheerfully issue you a brand new certificate against the same key you were using with CA #1 before something went badly wrong - but with cert SHAs you have to bootstrap all of that fresh if it happens.
If you pin keys you can even pin a key you haven't and never plan to use, keeping the corresponding private key in the company safe as a hedge against something going badly wrong.
- jcalvinowens 3y agoI completely disagree with you: reusing private keys is an enormous vulnerability. It's really important to rotate them. It's very easy to avoid the pitfall you mentioned by having multiple valid certs with different expiry dates. You can easily use multiple CAs. Done your way, a single leaked private key means your entire site is compromised indefinitely. That's unacceptable to me.
- tomputer 3y ago> reusing private keys is an enormous vulnerability. As long as the private key is stored/handled safely and RSA/ECC is not broken, it is not vulnerable. I do agree that key rotation is better/recommended practice. > a single leaked private key means your entire site is compromised The leak is the actual vulnerability. As long as the leak is still there and you are not aware of the compromised private key, a fresh new private key will probably leak again. However, the chances of leaking may be greater if a private key has to be used in multiple locations.