SSL Public Key Pinning HPKP

Andy · Dec 15, 2014

@eva2000
This sounds simple enough. Any reason we don't use it?
Public Key Pinning - Web security | MDN

eva2000 · Dec 15, 2014

interesting will read up.. thanks

seems only Chrome 38 desktop and Firefox 35 desktop and mobile browsers support Public Key Pinning SecurityEngineering/Public Key Pinning - MozillaWiki

eva2000 · Dec 15, 2014

FYI, Security/Server Side TLS - MozillaWiki

HPKP: Public Key Pinning Extension for HTTP
HPKP is an experimental HTTP header sent by a server to a client, to indicate that some certificates related to the site should be pinned in the client. The client would thus refuse to establish a connection to the server if the pining does not comply.

Due to its experimental nature, HPKP is currently not recommended on production sites. More informations can be found on the [MDN description page].
Click to expand...

eva2000 · Sep 2, 2015

HTTP Public Key Pinning Reporting support is coming in next Chrome 46 release Rolling out Public Key Pinning with HPKP Reporting — Google Web Updates

Chrome 46 ships with a feature called HPKP reporting, which can help you roll out a stricter form of SSL for your site.
Click to expand...

Using SSL on your site is an important way to preserve security and privacy for your users. But enabling SSL isn’t the end of the story: there are many steps you can take to further enhance the security that your site provides, from setting the Secure attribute on your cookies to turning on HTTP Strict Transport Security to using Content Security Policy to lock down your site’s privileges. Deploying these powerful features can sometimes be tricky, though. To help you roll out a stricter form of SSL, Chrome 46 ships with a feature called HPKP reporting.
Click to expand...
Should I go turn on HPKP right now?
Not necessarily. When you deploy HPKP, it’s quite easy to make a mistake and accidentally DoS your site. If you pin your site to one set of certificates and then have to deploy a new one, users who have seen the pin will be unable to access your site until the pin expires (based on the max-age value in the header).

Because it’s tricky to get right, HPKP is mostly used by a handful of high-profile, security-sensitive sites right now. If you decide to turn on HPKP, you should start with a very short max-age value and gradually increase it if you don’t have any problems.

What’s HPKP reporting and how does it help?
HPKP reporting, shipping in Chrome 46, is a feature that you can use to detect misconfigurations as you’re rolling out HPKP.

First, you can start by sending the Public-Key-Pins-Report-Only header instead of the Public-Key-Pins header:
Code:
Public-Key-Pins-**Report-Only**:
max-age=2592000;
pin-sha256="E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g=";
pin-sha256="LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=";
report-uri="https://example.net/pkp-report"
Click to expand...

Log in / Register

Forums

Want to subscribe to topics you're interested in?

SSL Public Key Pinning HPKP

Andy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

SSL Public Key Pinning HPKP

Andy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.