HPKP is HTTP Public Key Pinning, you aren&#x27;t pinning certificates, you&#x27;re pinning the public key. This means that you don&#x27;t necessarily need to change any pins when you renew certificates as the certificate can use the same key pair. The only time you need to consume a backup pin when renewing the certificate is if you have a new public key signed. I think it&#x27;s important to understand the difference before you try to deploy HPKP.<p>As for pinning the CA instead of your own public key, you can see my other comments in this thread with links about how GitHub pin their CA and a backup CA. I also have a link with information on the various levels in a chain you can pin at like the leaf, intermediate and root. Each has its own benefits and drawbacks.