The blog post you posted by Scott Helme is much better than the one I've seen posted in previous threads[0]. The information about not necessarily pinning to a

The blog post you posted by Scott Helme is much better than the one I've seen posted in previous threads[0]. The information about not necessarily pinning to a leaf is critical. Please Please Please read this. >For me personally, on my blog and on other websites that I run, I've pinned at the leaf certificate level. It does come with the problem that you're responsible for the backups... HPKP is a giant foot gun and even Ryan Sleevi expresses how he is somewhat unsatisfied with how HPKP turned out[1] and that you should be pinning to intermediates or roots.[2] (His name is on the RFC if you don't know who he is). In my opinion. If you plan to roll out HPKP you need to read the RFC. Don't follow online guides for your production environment. Figure out what is best for you. There is a really high operational cost to this in organizations bigger than a couple people. If you aren't prepared for that, then you're going to brick your site for a lot of users. Security headers are hard to get right and even some really big orgs make mistakes[3] 0 - https://scotthelme.co.uk/hpkp-http-public-key-pinning/ https://scotthelme.co.uk/hpkp-http-public-key-pinning/ 1 - https://twitter.com/sleevi_/status/696171562383224832 https://twitter.com/sleevi_/status/696171562383224832 2 - https://twitter.com/sleevi_/status/696379082599059457 https://twitter.com/sleevi_/status/696379082599059457 3 - https://chromium.googlesource.com/chromium/src.git/+/3865c64ae77925ee6b23de9aa61bd987871df13c%5E%21/ https://chromium.googlesource.com/chromium/src.git/+/3865c64...