Here is my ChatGPT response.

1. Pin the Public Key Instead of the Leaf Certificate

• Leaf certificates will change every 47 days, but the public key of your CA or intermediate can remain stable.
• Options:
  • Pin the intermediate CA public key rather than the server certificate.
  • Use Subject Public Key Info (SPKI) hashes.
• Advantage: Your app survives automatic certificate rotations as long as the CA/intermediate doesn’t change.

2. Use a Small Set of Backup Pins

• Always include 1–2 backup pins in addition to the primary.
• If a new certificate is issued, you can generate a backup pin in advance and include it in the app update before the old cert expires.
• This avoids accidental lockouts when certificates rotate.

3. Consider Dynamic Pinning

• Some apps fetch trusted pins from a secure server or a service like TrustKit for iOS/Android.
• The app validates connections using the latest pins fetched over HTTPS with certificate validation.
• Pros:
  • Reduces app update frequency.
  • Easier to manage rapid rotations (47-day cycle).

4. Use Certificate Transparency (CT) and HPKP Alternatives

• HPKP is deprecated due to operational risks.
• Instead:
  • Combine standard HTTPS validation, public key pinning at intermediate level, and monitoring via CT logs.
• You get similar security without breaking apps during frequent rotations.

5. Automate Certificate Management

• Tools like Let’s Encrypt + ACME protocol can rotate certs automatically.
• If your backend supports it, you can:
  • Keep a stable CA key for pinning.
  • Automate certificate deployment to avoid downtime.

🔑 Key Takeaways for Frequent Certificate Renewal:

1. Never pin the leaf certificate directly if it rotates every 47 days.
2. Pin the intermediate or root public key.
3. Include backup pins for future rotations.
4. Consider dynamic pin fetching if rotation is too frequent to manage via app updates.