You can pin a certificate higher in the chain, like the root cert of your CA. That way, you can still rotate your own cert, but an attacker couldn&#x27;t just install a new root cert in the machine, they would have to get a cert from the same CA as your own.