SSL Pinning and certificate expiry

Question

This question relates to the use of SSL Pinning in a client app against a web api and certificate expiry.

Scenario:

I own example.co

Answer 1

The mozilla developer site recommends to pin the certificate of the intermediate CA that signed the server certificate.

"it is recommended to place the pin on the intermediate certificate of the CA that issued the server certificate, to ease certificates renewals and rotations."

For more information on implementing and testing public key pinning you can refer Implementing and Testing HTTP Public Key Pinning (HPKP)