We are in the era of the Internet, and prioritizing the protection of connections between devices and websites is extremely important. In this context enters HTTP Public Key Pinning (HPKP), which is a great tool for enhancing security.
You can think of HPKP as a mechanism that establishes “pins” or “trust keys” between your browser and a web server. These pins serve as digital stamps, and their job is to ensure the authenticity and security of communication between the server and browser. This feature plays a key role in stopping cyber threats like identity theft by introducing an extra layer of validation.
In this article, we will take a look at the inner workings of HTTP Public Key Pinning (HPKP), we will see how important it is for web security, and how developers can implement it to keep the integrity of information online.
Table of Contents
What is HTTP Public Key Pinning?
HTTP Public Key Pinning (HPKP) works as a security feature in web browsers, guarding users against potential man-in-the-middle attacks exploiting fraudulent SSL/TLS certificates.
Its function involves website operators specifying a designated set of public keys associated with their domain, indicating the approved certificate authorities authorized to issue valid certificates for that domain. The act of pinning these keys enables browsers to identify and stop the use of unauthorized certificates, thereby increasing the overall security of the HTTPS connection.
However, as a result of potential HTTP misconfigurations leading to site disruptions, modern browsers have deprecated it. We advise web developers and admins to explore alternative security strategies for protecting their websites.
Mozilla says that “HTTP Public Key Pinning (HPKP) is an obsolete security feature that tells a web client to associate a specific cryptographic public key with a certain web server to decrease the risk of MITM attacks with forged certificates.”
The role of HTTP Public Key Pinning
As previously mentioned, HTTP Public Key Pinning serves as a security mechanism designed to protect HTTPS connections by stopping intermediary attacks. Instead of relying only on the SSL/TLS certificate chain for server authentication, HPKP enables a website to explicitly set the public keys required to establish a secure connection.
Upon encountering an HTTP Public Key Pinning header in the server’s response, a browser stores the fingerprints of authorized public keys for a designated period. This implies that even if an attacker manages to obtain a fraudulent certificate, they cannot establish a secure connection without the corresponding authorized public key.
Despite the additional security layer provided by HPKP, its implementation requires careful consideration, as errors may result in users being unable to access the site if key changes occur.
The inner workings of HTTP Public Key Pinning
The functionality of HPKP involves enabling a web server to outline a set of public key hashes within the HTTP Strict-Transport-Security (HSTS) header. These hashes play an important role as browsers use them to confirm that the certificate presented by the server during the connection matches with the pre-established public key.
The main objective of HPKP is to reduce the vulnerabilities linked to man-in-the-middle attacks, wherein a bad guy might use a fraudulent SSL/TLS certificate. Keep in mind that improper handling of public keys under HPKP can lead to accessibility challenges. As we have already mentioned, due to potential drawbacks, HPKP has been deprecated, and instead, adopting more contemporary mechanisms like Certificate Transparency is now recommended.
Why is HTTP Public Key Pinning obsolete?
HTTP Public Key Pinning was initially developed to increase the security of web connections, which was achieved by enabling web servers to communicate to browsers the specific public keys of SSL/TLS certificates to anticipate for a designated period. However, with time, HPKP has become outdated and discouraged for various reasons.
Initially, its implementation was intricate and prone to errors, leading to issues where legitimate websites were erroneously blocked due to security misconfigurations. Additionally, the rigid nature of fixed key policies introduced further security risks, as an unintentional alteration in keys could result in users being locked out of the site.
To make things worse for HPKP, the widespread acceptance of security infrastructure based on the Certificate Authority (CA) standard has lessened the necessity for it. Modern browsers rely on CAs to validate certificate authenticity, making key pinning redundant in most instances.
HTTP Public Key Pinning posed notable security risks, as inadequate implementation could expose vulnerabilities to potential attacks. Given the mix of complexity, risks, and the evolving landscape of security practices, HTTP Public Key Pinning has been labeled as obsolete. Thus, developers and system administrators have preferred more contemporary and secure approaches.
Data provided by Security Researcher Scott Helme tells that, at its peak, this feature was used by 3500 of the top 1 million websites.
The dangers of HTTP Public Key Pinning
Quite high, actually. The risks associated with HPKP stem from its lack of adaptability and the possibility of misconfigurations. If the keys of a website are altered for any reason, users might face difficulties accessing the site until the expiration of the pinning policy. This has the potential to lead to disruptions in service, particularly if errors occur in key management.
Additionally, should a site owner erroneously pin an inaccurate or compromised public key, it may result in a denial of service for users who have that key pinned. Recovering from such situations can prove to be challenging.
How to configure HTTP Public Key Pinning
If, despite the risks, you still want to set HPKP in your web server, we will tell you how to do so, but please keep in mind that HPKP is obsolete and won’t work in modern browsers.
First off, run the following to create your public key:
openssl rsa -in your_public_key.pem -pubout -outform der | openssl dgst -sha256 -binary | base64
And this one for your backup key:
openssl rsa -in your_backup_key.pem -pubout -outform der | openssl dgst -sha256 -binary | base64
You will need both in a minute.
Setting up HTTP Public Key Pinning in Apache
Open the Apache configuration file, like httpd.conf or your site-specific file.
Add the following line:
Header always set Public-Key-Pins "pin-sha256=\"base64+primary==\"; pin-sha256=\"base64+backup==\"; max-age=expireTime [; includeSubDomains][; report-uri=\"reportURI\"]"
Replace base64+primary== and base64+backup== with the SHA-256 hash values of the primary and backup public keys, respectively.
Optionally, include parameters like “includeSubDomains” or specify a report-uri for policy violation reports.
Restart Apache:
systemctl restart apache2
Enabling HTTP Public Key Pinning in Nginx
Open the Nginx configuration file, such as nginx.conf or your site-specific file.
Add the following line in the server section, replacing hash values using the ones you created a minute ago.
add_header Public-Key-Pins 'pin-sha256="base64+primary=="; pin-sha256="base64+backup=="; max-age=expireTime [; includeSubDomains] [; report-uri="reportURI"]';
You can optionally use the includeSubDomains parameter or define a report-uri.
Save the file and test your Nginx config before restarting the service:
nginx -t systemctl restart nginx
Configuring HTTP Public Key Pinning on IIS
Start by running the Command Prompt or PowerShell and proceed to extract the public key from your SSL/TLS certificate:
openssl x509 -in your_certificate.crt -pubkey -noout > public_key.pemNow generate the SHA-256 hash of the public key:
openssl dgst -sha256 -binary public_key.pem | openssl enc -base64Repeat the process for your backup certificate’s public key.
Now start the IIS Manager and select the desired site. Access HTTP Response Headers and click on Add.
Enter the following:
- Name: Public-Key-Pins
- Value:
- pin-sha256=”Base64PrimaryHash”;
- pin-sha256=”Base64BackupHash”;
- max-age=5184000; includeSubDomains
Don’t forget to replace Base64PrimaryHash and Base64BackupHash with your actual public key hashes.
Save the new settings.
Testing HTTP Public Key Pinning
Testing your current HTTP Public Key Pinning settings is pretty easy, just follow the steps below:
- Access our web security scanner.
- Input your domain in the scan box.
- Tick the two boxes below (‘Clear cache’ and ‘Follow redirects’).
- Click the Scan button.
- Now scroll down to the ‘HTTP Security Headers’ section and check the ‘HTTP Public Key Pinning’ results: a ‘Passed’ in green is good. However, if you get a ‘Failed’ in red, you must update your current settings.
HTTP Public Key Pinning FAQ
Let’s see a couple of the most common questions and concerns related to HPKP.
Is HTTP Public Key Pinning mandatory?
No, HPKP is not mandatory for any website. While it can provide an additional layer of security, it also introduces complexities and potential risks if misconfigured. An improperly implemented HPKP can lead to site outages if the pinned keys are changed without proper planning.
Due to these considerations, HPKP usage has declined, and its use is discouraged in favor of more modern security mechanisms like Certificate Transparency (CT) and HTTPS best practices.
Is HTTP Public Key Pinning obsolete?
Yes. HTTP Public Key Pinning (HPKP) is now obsolete. Initially created to boost security by protecting against malicious man-in-the-middle attacks, HPKP required browsers to enforce specific certificates. However, its implementation encountered issues, potentially causing sites to become inaccessible due to errors.
Also, the widespread adoption of Let’s Encrypt, offering free certificates with regular updates, decreased the necessity for HPKP. As technology progressed, vulnerabilities were uncovered, and HPKP was found to be susceptible to abuse. In the end, developers and browsers ceased support, deeming HPKP obsolete.
HTTP Public Key Pinning alternatives
As previously mentioned, HTTP Public Key Pinning is a security measure allowing websites to specify which SSL/TLS certificates are valid for their domain. However, due to implementation challenges and potential risks, HPKP was deprecated and removed in 2018.
Safer options have emerged, like Expect-CT and Certificate Transparency (CT). Expect-CT lets websites request browsers to validate a certificate’s existence in a transparency log. Meanwhile, Certificate Transparency (CT), a standard ensuring public disclosure of all issued certificates, offers transparency and detects malicious issuances. These alternatives enhance security without the associated risks of HPKP.
Summary
Today we have learned that HTTP Public Key Pinning operates as a security rule in web browsers, shielding us against potential man-in-the-middle attacks exploiting fraudulent SSL/TLS certificates. To use HPKP, website owners designate a set of public keys associated with their domain, specifying approved certificate authorities. This pinning process allows browsers to identify and prevent the usage of unauthorized certificates, which boosts the overall security of HTTPS connections.
Due to its complex implementation and potential drawbacks, HPKP is considered obsolete. Issues such as misconfigurations leading to site disruptions and the evolving security landscape have led developers to adopt more contemporary mechanisms like Certificate Transparency.