title: SSL Pinning and certificate expiry
body: <p>This question relates to the use of SSL Pinning in a client app against a web api and certificate
  expiry.</p>
  
  <p><strong>Scenario</strong>:</p>
  
  <p>I own <strong>example.com</strong> and have a subdomain where an <strong>api</strong> is hosted, as such: <strong>api.example.com</strong></p>
  
  <p>I wish to use the api over <strong>SSL</strong>, so an SSL Certificate is created for the subdomain.</p>
  
  <p>After the certificate has been acquired, I have:</p>
  
  <ul>
  <li>A Public Certificate</li>
  <li>A Intermediate Certificate</li>
  <li>A Private Key</li>
  </ul>
  
  <p>It's my understanding that I install these certificates on my webserver.</p>
  
  <p>I then wish for my client app to connect to the api. To mitigate against man-in-the-middle style
  attacks, I wish to use SSL Pinning, so that the client will only communicate with my api, not
  someone spoofing it.</p>
  
  <p>In order to pin in the client app, I have two choices, either pin against the public or intermediate 
  certificate.</p>
  
  <p>Let's say I implement this.</p>
  
  <p>What happens when the certificate on <strong>api.example.com</strong> expires?</p>
  
  <p>It's my understanding that the client app would no longer work.</p>
  
  <p>Do I need to regenerate a complete set of public/intermediate/private items again? and then
  put a new public or intermediate certificate in the app?</p>
  
  <p><strong>Question</strong>:</p>
  
  <p>I would still like the client app to work until the certificate on api.example.com was updated.
  Of course, a new certificate can be put in the client app, but things like roll-out take time.</p>
  
  <p>How can I handle this?</p>
  
  <p>I've read that Google updates their certificate every month, but somehow manages to keep the public key the same: <a href="https://stackoverflow.com/questions/15728636/how-to-pin-the-public-key-of-a-certificate-on-ios">How to pin the Public key of a certificate on iOS</a></p>
  
  <p>If that's possible, then the solution is to simply extract the public key from the server and check it against the locally stored public key...but how do Google do it?</p>
  
  <p>Thanks</p>
  
  <p>Chris</p>