Re:Microsoft silently adds Amazon root certificates to its CTL
by icebraining on Friday January 22, 2016 @07:18AM
(#10952267)
I can't say I know, but I don't think they can simply replace them at will, otherwise wouldn't existing certs just stop working?
[ Parent
| on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL
by viraptor on Friday January 22, 2016 @08:04AM
(#10952434)
The intermediates can be replaced without issues, as long as they link to the same root certificates. That's the standard way to rotate them when they expire, or get compromised.
Re:Microsoft silently adds Amazon root certificates to its CTL
by Buge on Saturday January 23, 2016 @03:55AM
(#10957727)
When are you talking about them being replaced? Because I thought website certificates embed the signature of the signer (the intermediate), so if the intermediate is revoked, my website's certificate won't work anymore. If that's the case I should be fairly safe pinning the intermediate for as long as my website certificate is valid.
Re:Microsoft silently adds Amazon root certificates to its CTL
by icebraining on Friday January 22, 2016 @09:55AM
(#10953001)
Ah, yes, but my suggestion was to pin the root.
Re:Microsoft silently adds Amazon root certificates to its CTL
by iancarroll on Friday January 22, 2016 @11:00AM
(#10953446)
CAs will not arbitrarily throw out their root certificates (they're quite expensive and valuable), so you'll be fine pinning to a root. I'd advise against it when you use OV or EV certificates though, as it'd allow for a DV certificate to still work.