The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid.
I have two questions concerning that because I couldn't find a good answer:
- Assume, the HTTP header says that the key pin is valid for 60 days (max-age). Where is it saved? When I delete my browser history and cache every day, is HPKP pointless then?
- Assume, I am on a website that supports HPKP and the HTTP header says that the key pin is valid for 60 days. Now, when I visit the website after a week again and the HTTP header is still the same, then it's valid for 60 days once more, right?