This Chrome behavior surprised me so I checked the source. Indeed, you are correct. Pin checking is short-circuited if the cert is signed by a root. ` if (!i

This Chrome behavior surprised me so I checked the source. Indeed, you are correct. Pin checking is short-circuited if the cert is signed by a root. ` if (!is_issued_by_known_root || !HasPublicKeyPins(host, sni_available)) { return true; } ` https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state.cc&q=kPreloadedSTS&sq=package:chromium&type=cs&l=137 https://code.google.com/p/chromium/codesearch#chromium/src/n...