3 ms·
You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.
by nickik 11y ago
You should also add HPKP (leaf pinning), it insanly powerful and a challange to get right. I have not figured out why the damn ssllabs complains about it to me.
- realusername 11y agoI wanted to add it but I've seen all these warnings on the Internet about it and I'm not so sure I will be able to manage it if it does not work as expected. I've added X-Frame-Options, Strict-Transport-Security, X-Xss-Protection and X-Content-Type-Options because they have very few side-effects but I'm a bit afraid of HPKP.
- tombrossman 11y agoI have the same problem, if I use one of the HPKP generators (or copy-paste a 'correct' example & substitute my cert hashes) I always get the SSL Labs error. Everything else is perfect. Depending on what guide I follow, I get Nginx errors, SSL Labs errors, or other third-party test errors. Never a consensus, which is what I would expect once everything is 100% correct. I'll have to set aside a few more hours to figure this out soon. Even good documentation like this is not working for me: https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...