Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. Basically this one will be used as webserver for personal storage of our family members, so we can share documents with each other independent of our current location. Because they are not very familiar with technology and stuff, I would like to secure the connection a bit more. Alongside web application for file storage I will create some easy website and in the future I think the webserver will also host blog. I decided to structure the website like this:
storage.domain.tld- for our personal storage
domain.tld- there will be some easy website (HTML file with CSS and JS files along)
domain.tld/blog- after some time I think this address will be used for blog
I will use StartSSL to sign my certificate which will be installed on webserver. Because HPKP requires backup certificate, I will also create additional certificate in case of any failure in the future. I think that after some reading I correctly understand how to configure HPKP, but I'm still not sure how to deal with subdomain and what exactly could be a problem if there is misconfigured HPKP header.
So first about subdomains... Most of our family members will just use
storage.domain.tld. StartSSL enables signing of certificate for main domain and one subdomain. Will browsers recognize HPKP header on subdomain if I set it only on
domain.tld and add includeSubdomains in it? What to do if browsers recognize HPKP header only on the domain you actually visit? I would also like to see some suggestions on this topic, because I'm out of ideas what to do here.
And the second thing about misconfigured HPKP. When I will set up everything, I think to set max-age of HPKP header to something around 60 (1 minute should be enough to test out if HPKP works correctly). After success I think to extend max-age to half year. If I understand correctly the browser just checks if public key in HPKP header is the same as the one of webserver. If there's a match, everything should be OK. So there is no connection to any other service for checking correct settings of HPKP? If I use browser in private mode and I visit my site with misconfigured HPKP, will this problem disappear if I remove HPKP header and visit site again in non-private mode?
I will appreciate all suggestions and comments to my questions. Thank you in advance!