For dyndns it's fairly easy to replace the machine behind a domain name: either if the subscription runs out or if the IP changes and the dyndns service hasn't been updated. In that case one can trivially request a new valid certificate with letsencrypt.

I have so far used HPKP to avoid this situation. Since HPKP is now a persona non grata, which alternatives exist?

Wikipedia mentions Expect-CT but that also doesn't help in this case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.