News for hackers. Stuff that matters.

A comment on Microsoft silently adds Amazon root certificates to its CTL. Parent comment

Re:Microsoft silently adds Amazon root certificates to its CTL by viraptor on Friday January 22, 2016 @08:04AM (#10952434)
The intermediates can be replaced without issues, as long as they link to the same root certificates. That's the standard way to rotate them when they expire, or get compromised.
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by Buge on Saturday January 23, 2016 @03:55AM (#10957727)
When are you talking about them being replaced? Because I thought website certificates embed the signature of the signer (the intermediate), so if the intermediate is revoked, my website's certificate won't work anymore. If that's the case I should be fairly safe pinning the intermediate for as long as my website certificate is valid.
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by icebraining on Friday January 22, 2016 @09:55AM (#10953001)
Ah, yes, but my suggestion was to pin the root.
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by iancarroll on Friday January 22, 2016 @11:00AM (#10953446)
CAs will not arbitrarily throw out their root certificates (they're quite expensive and valuable), so you'll be fine pinning to a root. I'd advise against it when you use OV or EV certificates though, as it'd allow for a DV certificate to still work.
[ Parent | on HN ]