News for hackers. Stuff that matters.
Re:Free, automated SSL certificates for Sandstorm self-hosters by geofft on Monday October 05, 2015 @05:41PM (#10335180)
You can prepare the spare certificate in advance: generate two private keys (preferably with different software on different machines), buy two certs, and only put one of them online. That way, if something goes wrong, you have a known-working certificate you can switch to. It doubles the cost, which may or may not be worth the money.

You're also allowed to pin any certificate in the chain, not just the end-entity cert (https://tools.ietf.org/html/rfc7469#section-2.6), so you have some other options. You can pin some number of CAs that you think are trustworthy CAs: pin not only GlobalSign but a few other major CAs that you'd consider using in the future. That doesn't protect you from all the things HPKP could possibly protect you from, but it does protect you from the DigiNotars and MCS Holdings and TURKTRUSTs of the world.

Re:Free, automated SSL certificates for Sandstorm self-hosters by blfr on Monday October 05, 2015 @09:55PM (#10336334)
You don't need to buy a spare cert in advance. You can use a a CSR, and only get it signed when necessary.