3

Some weeks ago, we enabled the HTTP Public Key Pinning header on our website. As per the specification, we included not only the SHA-256 fingerprint of our current RSA key, but also that of a backup (RSA) key.

Now, however, we would like to add a second (ECC) key to our site. We set up a testing server with two self-signed certificates (one RSA, one ECC). When watching the TLS handshake in Wireshark, it seems the server only sends one certificate (the ECC one). Using the -cipher option of openssl s_client, however, I can prove that both certificates can be delivered by the server (by forcing OpenSSL to either only use aRSA or ECDSA cipher suites).

In my understanding, when a visitor with a fairly modern browser is going to visit our production site, the server would present the ECC key only and the browser would complain to the user that it does not know that key, as it was not included in the HPKP header sent at the last visit. Is there a way to make the server (Apache 2.4.7) always present both certificates? Or does the browser somehow manage to obtain the (known) RSA key from the server?

Improve this question

2 Answers 2

Reset to default
3

Is there a way to make the server (Apache 2.4.7) always present both certificates?

No. This is by design in TLS. The server only presents the certificate after a common cipher suite has been negotiated.

And the cipher suite determines the certificate type (ECDSA or RSA). Then the server will know which of the certificates to use.

EDIT: See older question:
Here's one of my older answers to a related question:

SecSE:How does a browser choose which certificate to use if my web server has multiple certificates?

Improve this answer
3
  • You have Pin with HPKP : Key1 (Current RSA cert key fingerprint) and Key2 (backup key fingerprint) with a max-age of X days.
  • You want to use a ECC cert (so, with a new key not yet pinned).

  • You need to :

    1. Pin with HPKP Key1, Key2 and Key3 (ECC cert key fingerprint)
    2. wait at least the same time than the pinning expiration time : X days (to assert that all your visitors forgets the old pinning list)
    3. You can now use the RSA and the ECC certificate

You can't present the two certificate in the same time. When a key is pinned, the browser check that the key is in the current chain.

Improve this answer
3
  • My expiration time is 60 days. When can deploy a new cert?
    – Geremia
    Commented Oct 13, 2016 at 15:25
  • If the HPKP expiration time is 60 days and the cert you want to deploy is not valid for your HPKP, you must remove wait 60 days after you remove or Fix your HPKP header (you can fix it by adding the key of your new cert. of course you must keep the current and backup keys, for current until you change the cert, the backup until you decide you want another backup key).
    – Tom
    Commented Oct 13, 2016 at 17:18
  • But if your new cert use the same key as the old one, nothing to change, you can deploy anytime.
    – Tom
    Commented Oct 13, 2016 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .