Extended certificate

[maciekish]

What happens to pinning after a certificate has been extended? Does the info in TrustKit have to be updated or does the public key stay the same? Does it matter if you extend the certificate at the CA or just request a new one with the same old CSR?

[nabla-c0d3]

The key stays the same so the pinning configuration should not have to be updated. Here's a good guide on what certificate to pin and how to properly do it: https://scotthelme.co.uk/guidance-on-setting-up-hpkp/