HPKP will accept if <i>any</i> of the fingerprints match -- I was wondering how I could transition certificates when using it, and hadn&#x27;t noticed that fact. So to transition to a new certificate, specify the fingerprint of the old AND new certificates, for at least as long as the max-age. You can also specify the fingerprint of any certificate in the trust chain. I plan on pinning the let&#x27;s encrypt certificate, instead of the specific certificates let&#x27;s encrypt issues, and trusting let&#x27;s encrypt to implement the domain validation correctly.