3 ms·
How is HPKP supposed to work when you change certificates? The new certificates don't have HPKP and the site still relies on old HPKP. Letsencrypt certificate
by mozumder 9y ago
How is HPKP supposed to work when you change certificates? The new certificates don't have HPKP and the site still relies on old HPKP.
Letsencrypt certificates only lasts 90 days. It's a real pain-in-the-ass to figure out a process that allows HPKP with certificates that expire every 90 days.
- pfg 9y agoHPKP is based on the public key, not the certificate. You can continue to use a certificate with the same public key across renewals. You could even switch to a different CA if you pin to the key of your server (end-entity) certificate. That said, most experts recommend pinning to a number of CA roots or intermediates instead of pinning solely to keys under your control. (Backup pins to keys under your control are still recommended.)
- ivanr 9y agoIf you continue to use the same public key, your existing pin will work with your new certificate. So there's nothing to do. IIRC, many (all?) LE clients generate new keys by default, so this is something you need to plan for in advance. If you want to change your public key, you have to obtain your certificate in advance, then introduce its pin into your HPKP configuration at least N days before the certificate switch. In this case, N is your maximum HPKP policy duration. With this process you ensure that, when you do switch the certificates, all your users will have the correct pin for it. Whatever HPKP policy you had N+1 days prior, it will have expired by then. You probably want some additional safety margin there too.