So I'm implementing certificate pinning on iOS and it was recommended that we check the certificate chain using public key hash values.
The rationale for this lay in the fact that we were told that renewing the server certificate kept the same public key. As such, the certificate on the server could be renewed when it expired, and that such renewal would have no impact on the app.
IOW, I wouldn't need to update the app with a new certificate.
Note the certificates in question are signed by a public CA (Digicert).
Currently we get around the issue by pinning to the intermediate certificate that signed the leaf certificate (longer shelf life). Equally obviously, that's somewhat less secure than pinning to the leaf.
However, I've run across some comments that imply that renewing a leaf certificate creates a new public key. Particularly if that renewal is done by generating a new CSR.
So which is it?
Or to restate the question:
When I've installed certificates on a server, I've typically done so by creating a renewal CSR and giving it to the CA. When the CA gives me a new (renewed) certificate and I install it, will it have the same public key as the old certificate?
If the answer is always: yes, then I'm good. If the answer is no, then I need to do something else.
And if the answer is a definitive "maybe", then I'm pretty much in the same boat as a no.