3

I am trying to understand certificate pinning.

Google started adding a whitelist of CA certs that they use for their certificates and if a cert for a google service is issued outside of this list they deny it. That is straightforward.

But say I have a web site https://www.example.com how do I use certificate pinning to improve the security of HTTPS connections to my server? On any browser and not just Chrome. What kind of messages are exactly sent from the server to the client? Does HTTPs support pinning?

Improve this question

1 Answer 1

Reset to default
2

There are two things you can do.

The first thing you should look into is HTTP Strict Transport Security (HSTS). It's not pinning, per se, but it allows you to tell a browser to only ever visit your site over HTTPS, to prevent SSL stripping attacks.

As far as cross-browser pinning goes, there's no solid solution. However, there's a draft specification for a pinning header, which is explained briefly here. I have no idea what browser support is like for it, but it may be adopted in future.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .