From: grarpamp <gra...@gm...> - 2015-12-16 08:22:04
|
I've mentioned this before in a pile of crypto support stuff for fetchmail 7. Here's an example of a popular, likely geolocated / multihomed / proxied / etc, service where pinning one cert isn't enough in particular if the user is using global VPN-like services. -----BEGIN CERTIFICATE----- MIIEfjCCA2agAwIBAgIIWvnCfNoKjzowDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl cm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjEwMTc0NjQ0WhcNMTYwMzA5MDAwMDAw WjBnMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEWMBQGA1UEAwwNcG9w LmdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALl0v0j1 S96SIMojK/ACeP+MOVCS8yZdcdQkrosPQnJvgsby4kZ7ojK6vtiTZKmHkT/8BUGu u1a69y6zL11ZR1XQfCZCQnF1xb9CV+owu4Ol9GqCk9zsNpiI4jHXoobCtkYdFiH0 HfW+WgsUpx1vBhAaAJs5BmM5STm2F/XdIeWDNENrthbeyaL8VajLgGBCBzcgTlEe hC6m1keDIOwuFJ8JLflE+Wb4C5Nearzo5CjbLJxQzR8lxK/ctlu+rD7sZk22EMVk nga+zclgapzBVXt0hJmEBfaZgc/q1eFQS/Q5GfyLzESIxwb0dpmuKmOK626GBtVq KknyP7KMJxuIb/sCAwEAAaOCAUowggFGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr BgEFBQcDAjAYBgNVHREEETAPgg1wb3AuZ21haWwuY29tMGgGCCsGAQUFBwEBBFww WjArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29tL0dJQUcyLmNydDAr BggrBgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5jb20vb2NzcDAdBgNV HQ4EFgQUk9fmZ+inRFkE7LirsYW1mk2Y+xowDAYDVR0TAQH/BAIwADAfBgNVHSME GDAWgBRK3QYWG7z2aLV29YG2u2IaulqBLzAhBgNVHSAEGjAYMAwGCisGAQQB1nkC BQEwCAYGZ4EMAQICMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9wa2kuZ29vZ2xl LmNvbS9HSUFHMi5jcmwwDQYJKoZIhvcNAQELBQADggEBAElGQepKUUEZkp7D5OAL M0QbVf65jFxSmkrdoSsOg2reuRQDDw4+COIRJe9bifnFvbTF9QHXMMpxVzn4jQze bHje681FjnVCVuNE5sxEIwDlZuUwolN8q+T6GwriJyooKEC4ZAvHyDMK/Q6QjktZ GLLbA7hX48/oIPkDuo1uzZfOX+Bu9tDN9os8D4th4HT5y4g7Ju6MrfEX56p1LSB8 i2/Zx6uywqwozani5PJNWD4Em/SCdgZw1UDoR7ImIFDYJGPC60CN7Z0L/9kFd2Ye 6/g4PgDHNS5DdAY1t1Dj9yXJSResuZ/C6ewIfnLZnLfBlvFPL9ArZ2p03ehCDxfr KHY= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIEfjCCA2agAwIBAgIIZEfR3URZexYwDQYJKoZIhvcNAQELBQAwSTELMAkGA1UE BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl cm5ldCBBdXRob3JpdHkgRzIwHhcNMTUxMjAyMTUyNjA5WhcNMTYwMzAxMDAwMDAw WjBnMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEWMBQGA1UEAwwNcG9w LmdtYWlsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK/wNlwT a6QFjipNFZp9W0GbctN0PNwInZbpSvxkylmaR/MeTfBXFTkMKP/M0krhISWFbvBw dcsap23C3aLarsgXDflleSbujy+AsRl2RcgvjdiuOO3hb/NqZbRRQ+tRn9JnRLgO 7fN4wPVVXNKSAdGOAoh9aF72k8Pct8IalryFH+Evs0MdqT1ZSAdOF1RvlMq36Oxw C9VlpZsDZDDviFCaUDpb465l4JkAohKZlEzJbLVlcNlEvtnSshxjy6mWvXTDWM+Q XT6ZNPkK3M4lpCLrhxB1LiaFjdHKCBqlYLOmidq+aLH6ubvpPtUZrG9GIji4nZbl /mJMrjlQPod1SusCAwEAAaOCAUowggFGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr BgEFBQcDAjAYBgNVHREEETAPgg1wb3AuZ21haWwuY29tMGgGCCsGAQUFBwEBBFww WjArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29tL0dJQUcyLmNydDAr BggrBgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5jb20vb2NzcDAdBgNV HQ4EFgQUccsm05eNZmuy97BbLcmHvyEzZbQwDAYDVR0TAQH/BAIwADAfBgNVHSME GDAWgBRK3QYWG7z2aLV29YG2u2IaulqBLzAhBgNVHSAEGjAYMAwGCisGAQQB1nkC BQEwCAYGZ4EMAQICMDAGA1UdHwQpMCcwJaAjoCGGH2h0dHA6Ly9wa2kuZ29vZ2xl LmNvbS9HSUFHMi5jcmwwDQYJKoZIhvcNAQELBQADggEBAIYejPExKoIisbMHdvFn iOzrcCy1InNueMehndee0n7QuVI38I3f7cUn+UKZMrOiC3RTmUnsJOucO9Rp20Ob e1sKSUNWOKqcWFxIsiIYFeTevx3E12/4xMq/NSWDI4buxjLECWZsRB1cw/Q4uPGa SjlBp3T9/HXILvWhCVej0mplWUiiDHKnh0iXWkcpGAiI5cI6NMtSns7Y7kRI//yv zQL3cke6+IHJPGoItqwKrtltvpxmcke7Ewe7+Qmx8wBc187L90drLsYGrhYpaoYp JYbtsdsBZQ8QkBJ5+7+gLk3CR7ZtFsc5epCBfGD/pZtzMXzUP5tB/QoyuXl8R9/I RwE= -----END CERTIFICATE----- |