On Slack we collectively recalled that the reason we wanted to remove GMP certificate pinning entirely was that the Digicert intermediate CA ["old" DigiCert SHA2 Secure Server CA](https://crt.sh/?id=1262388) was expiring on 2023-03-08 which means that it can't be used to issue certificates anymore. :bhearsum pointed out that GMP certificate pinning is done by matching the CN, not the certificate serial number or sha256 hash, so we might be able to request a new certificate for balrog using the ["new" DigiCert SHA2 Secure Server CA](https://crt.sh/?id=3422153451) intermediate CA.
Bug 1768253 Comment 2 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
On Slack we collectively recalled that the reason we wanted to remove GMP certificate pinning entirely was that the Digicert intermediate CA ["old" DigiCert SHA2 Secure Server CA](https://crt.sh/?id=1262388) was expiring on 2023-03-08 which means that it can't be used to issue certificates anymore. :bhearsum pointed out that GMP certificate pinning is done by [matching the CN](https://searchfox.org/mozilla-central/source/modules/libpref/init/all.js#4128), not the certificate serial number or sha256 hash, so we might be able to request a new certificate for balrog using the ["new" DigiCert SHA2 Secure Server CA](https://crt.sh/?id=3422153451) intermediate CA.