I am dealing with a unique scenario where I have a mobile app that is unable to be updated on the App Store and has implemented SSL pinning. The issue is that the app pins against Lets Encrypt, which now will be moving to new certificates that are not pinned. As a backup, the app pinned a number of other certificates:
@"nKWcsYrc+y5I8vLf1VGByjbt+Hnasjl+9h8lNKJytoE=", // Intermediate DigiCert Global Root CA
@"E3tYcwo9CiqATmKtpMLW5V+pzIq+ZoDmpXSiJlXGmTo=", // Intermediate DigiCert Global Root G2
@"r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=", // DigiCert Global Root CA
@"i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY=", // DigiCert Global Root G2
@"h6801m+z8v3zbgkRHpq6L29Esgfzhj89C1SyUCOQmqU=", // GeoTrust Global CA
@"q5hJUnat8eyv8o81xTBIeB5cFxjaucjmelBPT2pRMo8=", // GeoTrust Primary Certification Authority – G3
Originally, the developer intended RapidSSL to be used as a backup if this situation arose, with them being able to get certificates from RapidSSL that contained any one of these certificates in the trust chain. I am tasked with purchasing a certificate that achieves this, but I am not able to find any concrete information on how I would go about finding a certificate that would meet this requirement.
I was looking at DigiCert for a Basic OV certificate, with the assumption that the DigiCert Global Root CA would be somewhere in the trust chain. Would this be correct? Is there anywhere that I could see an existing certificate so I can see what the trust chain contains?
