You can also pin the public keys of certificate authorities to limit which ones can issue for your domain and not have to worry about key backups. GitHub do this as you can see here: <a href="https:&#x2F;&#x2F;report-uri.io&#x2F;home&#x2F;pkp_analyse&#x2F;https%3A%2F%2Fgithub.com" rel="nofollow">https:&#x2F;&#x2F;report-uri.io&#x2F;home&#x2F;pkp_analyse&#x2F;https%3A%2F%2Fgithub....</a><p>I also have a blog on the various places you can pin like the leaf, intermediate and root: <a href="https:&#x2F;&#x2F;scotthel.me&#x2F;k2h" rel="nofollow">https:&#x2F;&#x2F;scotthel.me&#x2F;k2h</a>