According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup.

Any security measure is only as good as its weakest link, so in this case if we're pinning to the leaf but falling back to the intermediate if the leaf pinning fails, then why is this any better than simply pinning to the intermediate CA only in the first place?

1 Answer 1


I think OWASP suggests the intermediate CA pinning only temporarily to mitigate the risk of a DoS due to the leaf certificate expiration (that is now every year):

“ For example, the application pins the remote endpoint leaf certificate but includes a backup pin for the intermediate CA. This increases the risk by trusting more certificate authorities but decreases the chances of bricking your app. If there's any issue with the leaf certificate, the app can always fall back to the intermediate CA until you release an app update.”

On certificate pinning I personally think that it introduce some risks of auto DoS.

And I read that is considered now a sort of bad practice.


  • That makes sense. However the OWASP guidance then goes on to recommend pinning SPKI. If you are pinning SPKI then the risk of leaf expiry causing DoS due to the pinning configuration should be irrelevant. The advice is further complicated by the statement "If there's any issue with the leaf certificate", which implies any failure to validate the pin to the leaf whatsoever, should result in fallback to intermediate, which negates any benefit to pinning to leaf!
    – jon
    Commented Mar 27, 2023 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .