I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites.
But there are some sites which use HTTP Public Key Pinning to prevent MitM attacks and this is a real pain because the systems behind the firewall have not just been setup and have pinned public keys in some cases which then breaks SSL for those sites.
One way to get around this is disabling HPKP which is possible in firefox by setting
0 and it works well. Is there another way to get around this problem?
// The host I tried this on was a Kali machine with the Iceweasel browser.
The Error that was shown to me said the connection was droppen because of HSTS which was of cause very confusing because there were also websites that are using HSTS and the interception worked just fine. I then figured out that this seemingly has to do with HPKP and after disabling it the HSTS errors didn't show up anymore.
This seems to be a software specific issue. After @Steffen Ullrich Pointed out to me that this should not be happening I tried it with a Windows 7 Client and Chrome as a browser and it worked just fine.