aboutsummaryrefslogtreecommitdiffstats
path: root/certs
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2024-06-13 03:32:04 +0200
committerGuilhem Moulin <guilhem@fripost.org>2024-06-13 16:48:05 +0200
commit9cb882a468843bf8ce9598de8769d5baaaaae3ea (patch)
treee53a8783f8658bcf0d9778bc07037ec06e5b18f4 /certs
parentbf4d2d13ffcd894c6e7765dbd366f1163c69c9e1 (diff)
Fix post-issuance validation logic.
Rather than adding intermediates in the certificate bundle we now validate the leaf certificate with intermediates as untrusted (used for chain building only). Only the root certificates are used as trust anchor. Not pining intermediate certificates anymore is in line with Let's Encrypt's latest recommendations: Rotating the set of intermediates we issue from helps keep the Internet agile and more secure. It encourages automation and efficiency, and discourages outdated practices like key pinning. “Key Pinning” is a practice in which clients — either ACME clients getting certificates for their site, or apps connecting to their own backend servers — decide to trust only a single issuing intermediate certificate rather than delegating trust to the system trust store. Updating pinned keys is a manual process, which leads to an increased risk of errors and potential business continuity failures. — https://letsencrypt.org/2024/03/19/new-intermediate-certificates:
Diffstat (limited to 'certs')
0 files changed, 0 insertions, 0 deletions