I have a question: how I can prevent this error from server side? We have a new cert, and it's valid, but users getting this error.

Earlier, I've added HTTP response header Public Key Pins with 1 valid key, but I've deleted it from IIS.


1 Answer 1


In this case you have to wait until the time period you set in max-age is passed.

In this situation it's better to roll back to the old certificate, add a new pin to Public-Key-Pins header and wait for some time until the vast majority of clients receive the updated header.

In future, just don't rely on only one pin - always have a reserved certificate.

  • Thanks, but if remove this header, those browsers, that have cache broken version, still will have this error?
    – bodzin
    Commented Jul 6, 2016 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .