Collaborate Disseminate
Is it possible that Firefox and Chrome disable pin validation for users who imported custom root certificates all pinning violations are ignored. What is impact of that? Will browser report any warning?
Continue reading can HPKP certificate pinning disable DPI inspection on firewall?
Recently I was searching for some example configuration files for HPKP in CMSs like Drupal, Wordpress or Joomla, but I can’t find information about this. Is there a specific configuration for these CMSs or should I apply the … Continue reading Is there a HPKP configuration for specifics CMS?
I have seen not many Web sites do not implemented the HPKP even though it is a simple implementation. Is there any downside to this ?
I was looking at HTTP Strict Transport Security (HSTS) implementation in firefox. Firefox stores this data for sites in a file called SiteSecurityServiceState.txt
I see entries in it like –
support.mozilla.org:HPKP 3 … Continue reading What is HPKP and how does it work in case of websites
We are currently looking into enabling HTTP Public Key Pinning on our website. The problem we are currently facing is that our certificates last only 90 days, but we have devised the following steps to resolve this issue:
W… Continue reading What is the maximum amount of certificates that can be pinned with HPKP?
A remote code execution in Firefox caused by the expiration of certificate pins was patched by Mozilla in Firefox 49 and Firefox ESR 45.4. Continue reading Mozilla Patches Certificate Pinning Vulnerability in Firefox
Mozilla is expected tomorrow to patch a critical certificate pinning vulnerability in Firefox’s automated update process for extensions. Continue reading Mozilla Patching Firefox Certificate Pinning Vulnerability
I’m currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites.
But there are some sites which use HTTP Public Key Pinning to prevent MitM attacks and this is a real … Continue reading Is SSL Interception possible without disabling Public Key Pinning on the client side?