14

I've thinking in using HSTS in my sites but I don't understand if I need to sync the HSTS timing with the time when the certificate is going to be renewed or not.

Can I use safely a static time for HSTS? I would like to send always the same time in HSTS and to not have any problem when I renew the SSL certificate.

I'm worried about block access to my site due to not using properly HSTS.

Improve this question

1 Answer 1

Reset to default
20

HSTS only forces a site to use HTTPS. This prevents downgrade attacks such as SSLstrip from being effective. As HSTS says nothing about the certificate that will be used, it has no effect when you renew your certificate. (Note that the certificate will still need to pass all standard validity checks.)

HTTP public key pinning, a related technology, is used to force a browser to only allow a site to be visited with a certificate using a specific public key. Note that this is different than specifying a full certificate. Even when HPKP is used, a new certificate can be installed on the server, provided that it uses the same private, public key pair.

Improve this answer
5
  • Are you sure what you say is correct? in RFC6797 (HTTP Strict Transport Security (HSTS)), section 8.4 it says that "When connecting to a Known HSTS Host, the UA MUST terminate the connection [...] this includes any errors found in certificate validity checking that UAs employ, such as via Certificate Revocation Lists". That is what I don't fully understand and worries me.
    – Eloy Roldán Paredes
    May 29, 2016 at 5:49
  • 4
    @EloyRoldánParedes HSTS requires that your certificate be valid. So don't replace it with an expired or revoked or otherwise invalid one. :-P You can switch between different good certificates as often as you want.
    – Matt Nordhoff
    May 29, 2016 at 5:56
  • 4
    @EloyRoldánParedes Unless your new certificate will be invalid or revoked, which is unlikely to be the case as long as it's issued by a legitimate authority, the change won't present a problem. Once you switch to the new certificate it won't matter if your old certificate is revoked, either. As long as the certificate you are currently using (old or new) is good, HSTS is happy.
    – tlng05
    May 29, 2016 at 6:01
  • For this answer to be correct I think you should fix "As HSTS says nothing about the certificate that will be used, it has no effect when you renew your certificate.". Please, see the comments, certificate should be valid.
    – Eloy Roldán Paredes
    May 29, 2016 at 8:07
  • @EloyRoldánParedes answer updated
    – Neil Smithline
    May 29, 2016 at 14:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .