Short chain and DANE

We plan to begin issuing from intermediates unpredictably, so (for example) you wouldn't know if your cert is going to come from R3 or R4 until you have it in hand. Keep an eye out for more about this in the near future; this thread isn't the place to go into details.

Unless one can have multiple DANE-TA(2) records indicating multiple equally-trusted pinned CA pubkeys? It seems like that's what the table at the bottom of your post is indicating, as otherwise there would be no reason for anyone to have pinned R4 or E2 so far.

4 Likes