LetsEncrypt Client Pinning

Client dev
1

I’m working on a Let’s Encrypt client, and have a question about pinning.

Would it be advisable to pin one of the certificates in the certificate chain for ACME itself, such as TrustID Server CA A52?

We’d like to pin a certificate for the Boulder server in our client, but if there is no reasonable assurance that the intermediate’s public key won’t change unannounced, we’ll have to skip the idea.

On a slightly related thought, it would be nice if LetsEncrypt advertised what public keys to pin, probably using the standard Public-Key-Pins HTTP header so that clients which want to pin against LetsEncrypt’s ACME CA, can.

2

I would strongly discourage you from pinning any certificates in your ACME client. As you’ve no doubt noticed, we don’t currently set an HPKP header, so we’re not committing to serve any particular certificate chain for the API.

Thanks,
Jacob

3

Jacob,

Thanks for clarifying. We won’t do pinning, hopefully one day it’s something that LE can do.

4

Indeed, would be nice to have a HPKP header for the API. And LE clients should of course respect this header if possible.