9

I've thinking in using HSTS in my sites but I don't understand if I need to sync the HSTS timing with the time when the certificate is going to be renewed or not.

Can I use safely a static time for HSTS? I would like to send always the same time in HSTS and to not have any problem when I renew the SSL certificate.

I'm worried about block access to my site due to not using properly HSTS.

14

HSTS only forces a site to use HTTPS. This prevents downgrade attacks such as SSLstrip from being effective. As HSTS says nothing about the certificate that will be used, it has no effect when you renew your certificate. (Note that the certificate will still need to pass all standard validity checks.)

HTTP public key pinning, a related technology, is used to force a browser to only allow a site to be visited with a certificate using a specific public key. Note that this is different than specifying a full certificate. Even when HPKP is used, a new certificate can be installed on the server, provided that it uses the same private, public key pair.

  • Are you sure what you say is correct? in RFC6797 (HTTP Strict Transport Security (HSTS)), section 8.4 it says that "When connecting to a Known HSTS Host, the UA MUST terminate the connection [...] this includes any errors found in certificate validity checking that UAs employ, such as via Certificate Revocation Lists". That is what I don't fully understand and worries me. – Eloy Roldán Paredes May 29 '16 at 5:49
  • 3
    @EloyRoldánParedes HSTS requires that your certificate be valid. So don't replace it with an expired or revoked or otherwise invalid one. :-P You can switch between different good certificates as often as you want. – Matt Nordhoff May 29 '16 at 5:56
  • 3
    @EloyRoldánParedes Unless your new certificate will be invalid or revoked, which is unlikely to be the case as long as it's issued by a legitimate authority, the change won't present a problem. Once you switch to the new certificate it won't matter if your old certificate is revoked, either. As long as the certificate you are currently using (old or new) is good, HSTS is happy. – tlng05 May 29 '16 at 6:01
  • For this answer to be correct I think you should fix "As HSTS says nothing about the certificate that will be used, it has no effect when you renew your certificate.". Please, see the comments, certificate should be valid. – Eloy Roldán Paredes May 29 '16 at 8:07
  • @EloyRoldánParedes answer updated – Neil Smithline May 29 '16 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.