HTTP Public Key Pinning (HPKP)

[rugk]

Continuing the discussion from Maximum (and minimum) certificate lifetimes?:

@eva2000

@jcjones

I'm told right now the idea is regenerate by default -- but there should be a config parameter to change to re-using the existing CSR/private key. Clearly that's what you and I want to turn on.

Having a backup key is still extremely critical for compromise recovery, so it's still something that should have great care taken in implementation.

that's indeed best

what config paramter is for re-using existing CSR or existing private key ?

[rugk]

@jcjones

@rugk

The only bad thing is that occasional visitors (who only visit the site after 90 days) do not benefit from the security mechanism HPKP.

HPKP works off the SPKI (public key hash), not the certificate. That's why you can generate the hash from the private key file before you even generate a CSR. As long as you don't regenerate your site's private key, you don't need to do staggered key rollovers with 90 day limits, you can push that out to nicer, longer timeframes.

Yes, I'm aware of this. The part you quoted from my reply was intended for @My1 as a reply to his/her idea of automating this.
As I also describe later in the post you quoted it's of course possible to use the same HPKP hash longer than 90 days.

However I was not aware of the fact that the LE client regenerates the private key every time. That's very interesting (and quite important) to know, so thanks for mentioning this.

[rugk]

Another thing I’d like to add (ask) to (in) this HPKP discussion is:

AFAIK the LE often requires the server operator to cryptographically prove (aka sign) that he owns the private key of a (previously) used certificate.
However in case of HPKP and an attack you may get problems, because if your server is compromised and you have no way to get to the private key, so you have to reset your server, you may get problems with this challenge.
This may be problematic when you want to get a backup cert signed by LE after an attack.

So this means you should always also backup the currently used certificate.

---

Please correct me if I am wrong, because I only had this cryptographically verification in mind and thought this could be an issue here.

[My1]

yeah this is a bit stupid why not rrather require the account key?

[kelunik]

I think this is only required when issuing a certificate while there’s currently another service active at domain.tld:443. I shut down my previous server and issued the certificate, I didn’t have to provide any possession information, maybe because LE didn’t know the state before in this situation.

[rugk]

If you do not want to pin your leaf certificate (which would be the most secure, but most risky option) you can also pin the intermediate certs of LE. Here is a detailed guide how you can do it:

HPKP best practices if you choose to implement

H…