Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Note the "if you pin them" part. Pin in this context means you have the identity of the specific certificate stored on your client, and so you are not depending on whether or not it is being declared by some CA to be be valid for the server in question. Instead you are expecting that exact certificate.

That it is a private cert does not make it any more secure, but pinning is more secure, and with a pinned cert, having the cert signed by a CA gives no additional security.




And how do you know you're not pinning the MTIM cert?


Because it's your cert that you just installed on your server, so you know its thumbprint.

This is effectively what you are doing every time you connect to a server over SSH and say 'yes' to that message with the funny string asking, "Are you sure you want to connect?" It's analogous to pinning a self-signed certificate.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: