Some weeks ago, we enabled the HTTP Public Key Pinning header on our website. As per the specification, we included not only the SHA-256 fingerprint of our current RSA key, but also that of a backup (RSA) key.
Now, however, we would like to add a second (ECC) key to our site. We set up a testing server with two self-signed certificates (one RSA, one ECC). When watching the TLS handshake in Wireshark, it seems the server only sends one certificate (the ECC one). Using the
-cipher option of
openssl s_client, however, I can prove that both certificates can be delivered by the server (by forcing OpenSSL to either only use aRSA or ECDSA cipher suites).
In my understanding, when a visitor with a fairly modern browser is going to visit our production site, the server would present the ECC key only and the browser would complain to the user that it does not know that key, as it was not included in the HPKP header sent at the last visit. Is there a way to make the server (Apache 2.4.7) always present both certificates? Or does the browser somehow manage to obtain the (known) RSA key from the server?