Cert pinning

[Gary E. Miller]

Yo Richard!

On Thu, 28 Mar 2019 17:55:36 -0500
Richard Laager via devel <devel at ntpsec.org> wrote:

> On 3/28/19 5:47 PM, Gary E. Miller via devel wrote:
> > Don't care.  I like that the cert is pinned.  
> 
> There is a downside. Every time it changes, you have to take a leap of
> faith when you re-pin it, rather than getting normal CA validation.

You miss the point, this is addition to normal CA validation, not
an alternative to it.  Just like HPKP.

RGDS
GARY
---------------------------------------------------------------------------
Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703
	gem at rellim.com  Tel:+1 541 382 8588

	    Veritas liberabit vos. -- Quid est veritas?
    "If you can’t measure it, you can’t improve it." - Lord Kelvin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 851 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ntpsec.org/pipermail/devel/attachments/20190328/cf0fbe36/attachment-0001.bin>