HPKP

HTTP Public Key Pinning (HPKP) is a security mechanism defined for HTTP responses that allows a website to declare which public keys are authorized to sign its TLS certificates. By publishing pins, a site can reduce the risk of misissued or compromised certificates being trusted for that site.

HPKP works by having the server send an HTTP header, Public-Key-Pins, (and a report-only variant, Public-Key-Pins-Report-Only) with parameters such as max-age, pin-sha256 directives, and optionally includeSubDomains and report-uri. Each pin-sha256 value is the base64-encoded SHA-256 digest of the SPKI (the public key information) of an approved certificate key. During the max-age period, clients must accept a certificate chain that contains at least one pinned key; otherwise, they should terminate the connection. The report-uri parameter can cause the client to send violation reports to a monitoring endpoint.

Deployment requires careful planning. Operators typically pin multiple keys (including a current and a backup key) to allow key rotation without breaking users. Misconfigurations or loss of all valid pins can lock users out of a site, a risk that contributed to HPKP’s abandonment by many operators. The report-only mode provides a way to observe violations without enforcing pins.

Status and legacy: HPKP saw limited adoption and, due to its operational risk, has been deprecated by major browsers and is no longer recommended for new deployments. Modern TLS security practice has shifted toward Certificate Transparency, Expect-CT, and server-side certificate lifecycle management, rather than client-enforced pinning.