OVH automatically migrates expiring paid SSL to Let's Encrypt certificates

Re:OVH automatically migrates expiring paid SSL to Let's Enc... by ris on Sunday November 13, 2016 @03:48PM (#12945571)

...and what if you have a specific certificate pinned in your private clients for use of a private web service?

[ Parent | on HN ]

Re:OVH automatically migrates expiring paid SSL to Let's Enc... by Pirate-of-SV on Sunday November 13, 2016 @03:54PM (#12945606)

Then you should probably renew the expiring cert.

[ Parent | on HN ]

Re:OVH automatically migrates expiring paid SSL to Let's Enc... by an_account_name on Sunday November 13, 2016 @04:26PM (#12945767)

If you pinned the leaf cert, you're fucked in any event. If you pinned the CA, it's problematic for something to automatically choose a new CA for you.

[ Parent | on HN ]

Re:OVH automatically migrates expiring paid SSL to Let's Enc... by KenanSulayman on Sunday November 13, 2016 @03:57PM (#12945625)

Doesn't matter, you'll need a new certificate either way.

[ Parent | on HN ]

Re:OVH automatically migrates expiring paid SSL to Let's Enc... by darklajid on Sunday November 13, 2016 @08:01PM (#12946755)

Your point isn't bad, you just ignored/overlooked the 'expiring' part of the announcement.

If you don't pay for the renewal, pinning _probably_ is broken anyway (unless you somehow pin a cert, but ignore validation. In which case you should've used a self-signed cert from the start, I guess).

Honestly, I cannot see a downside to this. People that won't pay the CA mafia will get a cert for free. TLS everywhere. The internet wins.

[ Parent | on HN ]