HPKPs

HPKPs (HTTP Public Key Pins) refer to a mechanism in which a web server can declare which public keys are trusted for a given host by sending pins in the Public-Key-Pins HTTP header. The pins are typically generated as base64-encoded SHA-256 hashes of the SPKI (Subject Public Key Info) of the server’s legitimate certificates. By publishing pins, a site attempts to reduce the risk of trusted certificate misuse or man-in-the-middle attacks involving compromised or misissued certificates.

The core components of HPKP are the pin values themselves and a set of directives. The Public-Key-Pins header includes one or more pin-sha256 directives, each containing a pin value. It also includes a max-age directive, which specifies the duration (in seconds) for which the pins should be enforced by clients. Optional includeSubDomains indicates that the policy applies to all subdomains. A report-uri directive (or later report-to) can be used to collect violation reports when a connection presents a non-pinned key. A separate Public-Key-Pins-Report-Only header allows reporting violations without enforcing pins.

Deployment considerations are critical. Misconfigurations can lock users out of a site if pins are lost or rotated incorrectly. Pins must cover the current key and at least one backup key to allow safe rollover. Some sites explore preloading pins into browsers, but this approach is complex and risky. In practice, HPKP earned limited adoption due to the potential for catastrophic outages from pin mismanagement.

Today, HPKP is largely deprecated and unsupported by major browsers. The standard RFC 7469 remains part of historical security literature, but operators are advised to rely on alternatives such as TLS with Certificate Transparency, strict certificate management, HSTS, and application-level pinning where appropriate.