Changing a pinned key changes the application's trust model. A backup pin should represent a deliberately authorized future transition.
Evaluation approach
Assign responsibility for backup-key storage, activation and retirement. The transition extends beyond replacing a server certificate.
Application example
Test old and new application versions operating together and monitor errors by release.
Limits and considerations
An emergency path that accepts any certificate defeats the protection objective.
When should a backup key be tested?
Exercise the transition before an outage. A correctly configured server does not alone prove that older clients can connect.
Checks and decisions
- Define the transition window
- Test older clients
- Bound emergency behavior
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.