CA changes can happen due to many legitimate regions. Pinning certificates in th... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		supriyo-biswas on Nov 2, 2023 \| parent \| context \| favorite \| on: Last Chance to fix eIDAS: Secret EU law threatens ... CA changes can happen due to many legitimate regions. Pinning certificates in this way doesn’t scale, as we saw with the deprecation of HPKP.

Jensson on Nov 2, 2023 [–]

All you need is a list of trusted CA's, like we do right now, and then issue a warning if it isn't on that list. It is a very simple plugin to make.

g-b-r on Nov 2, 2023 | [–]

These certificate authories will also issue legitimate certificates btw, the regulation explicitly encourages local states to use them for their services

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact