Unverified50% confidenceOpinionExact time
A rejection mechanism based on public key hashes is more precise than one based on CA names or root certificates, because the same CA may issue certificates with multiple different public keys, and attackers may also abuse certificates through cross-signing and other means.
1
Sources
50%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedCertificate pinning can defend against man-in-the-middle attacks: even if an attacker holds a valid certificate issued by a trusted CA, the connection is still rejected as long as the public key hash does not match the pinned value.80% similarUnverifiedSSL Pinning机制在客户端代码中硬编码服务器证书的公钥指纹或证书哈希，拒绝接受非预期CA签发的证书，即便该CA已被系统信任库收录75% similarUnverifiedThe security of the CA trust system depends on its weakest CA — if any CA is compromised or has validation flaws, it may result in legitimate certificates being issued for domains not owned by the requester.75% similarUnverified多因素身份验证（MFA）在认证层面增加第二道防线，即便凭证泄露，攻击者也无法仅凭账号密码完成身份验证67% similarUnverifiedRejecting specific SPKIs this time is a continuation of Go's proactive defense strategy, but being precise down to the public key level means that even if a CA as a whole remains trusted, its specific public keys can be individually marked as untrusted.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1073185API
curl https://kongchang.com/api/v1/knowledge/claims/1073185MCP
get_claim(id=1073185)