Pinning of Certificates and Public Keys

What is HTTP Public Key Pinning?

Public key pinning allows you to specify your public key set for a future SSL/TLS connection to your host. This extension is based on the HTTP transfer protocol. What's special about it is that the accessing client only learns which public key is trusted for establishing a connection to the host at the moment of contact. For this reason, HTTP public key pinning is also called "trust on first use". The verified encryption - called pin - gives the mechanism its actual name. The important thing about this procedure is that the pins created are stored in the HTTP header by the client for a specified period of time. If the client tries to connect again, the certification chain is verified again. This verification process, also known as pin validation, is a key aspect of pinning and should be considered a digital signature.

How does Pinning Work

Public key pinning is a way to make your SSL connection much more secure via SSL certificates. Its purpose is to always determine at what point the public key changes from a host's certificate. This can happen, for example, if an attacker compromises the Certification Authority. Once an SSL connection is established, the browser uses HTTP private key pinning to check the stored pin of the host name. In this way, it can check whether the so-called SPKI fingerprints within the certificate chain are correct. If the verification fails, the connection is terminated immediately. If you choose not to use HTTP private key pinning, the connection will still be established.

These are the Steps Pinning goes Through

The flow is as follows:

• Generate a private key - both a primary and a back-up key.
• Generate the CSRs for both private keys.
• Generating the SPKI fingerprints for both public keys.
• The configuration of the virtual host is adjusted.
• In the last step, the pinning of the public keys is performed.

Basically, proper encryption as well as a digital signature are enormously important when it comes to working with digital data. This is especially true if you access data packets on the go or send them remotely. In such cases, it is essential that the entire path of transmission remains secured.

Using Pinning Securely

The pinning method is considered a secure option to explicitly define which certificates a website allows for the encrypted connection. If the TOFU circumstance is disregarded, this approach can resolve the trust issue of the public key infrastructure. This is because the browser knows who has accessed the domain and which certificates are acceptable to it. As a result, if the server sends a security certificate that is not known, the connection will be rejected directly.

Watch out for Pitfalls in the Details

Important to know: This approach can also have its pitfalls. This would be the case, for example, if your website can no longer use the certificates of the communicated pins. In such a situation, the browser would reject your connection attempts. For you, this means that you will not be able to use the website until the pin information expires. Therefore, it is important that you weigh the benefits of HTTP public key pinning as well as the risks. If you pin your own certificates, you need to constantly check the header that is delivered. In addition to securely applying and storing your pins, you need a rolling renewal process. This process tests your pins first and checks them periodically. A pre-built mechanism that provides a Public-Key-Pins-Report-Only header is suitable for this. This means that while the system does not enforce the policy mandatorily, you will receive information about possible violations.

Risks of Pinning

HTTP public key pinning is not without risk. Before relying on this mechanism, you should consider whether pinning can be sufficiently implemented in your case. The following risks may arise in connection with this approach:

• If the key on the server changes, the app can no longer reach your [backend](https://careerfoundry.com/en/blog/web-development/whats-the-difference-between-frontend-and-backend/). With a regularly rotating key or certificate, this can quickly become a serious problem.
.
• If you are using an option like NS Pinned Leaf Identities, set a direct server key. This simplifies your next steps but assumes that your key management is extremely secure.
• You should also be careful with managed cloud solutions. If they are ready-to-use API gateways, you rarely have the keys in your own hands. A classic example of this is the [root CA certificates from Microsoft.](https://docs.microsoft.com/en-us/microsoft-365/compliance/encryption-office-365-certificate-chains?view=o365-worldwide)
• Faulty configurations carry the risk of irrevocably locking you out as a website operator. Therefore, it is important to exercise special caution here and put the pinning in the hands of your experts.
.

Despite this, Pinning is Beneficial

However, pinning has its advantages not only in the field of websites: It is also gaining more and more importance among apps. After all, at this point it helps to keep the risks posed by apps low. With regard to apps, you benefit from two advantages: On the one hand, app providers often control both endpoints, and on the other hand, an independent recovery channel exists.

Conclusion - Key pinning Protects against Malicious Certificate Authorities

HTTP Public Key Pinning - also known as HPKP - provides you with a technology that solves numerous problems with certificate authorities. This ensures you that your website users are connected to the correct domain. Falsification can thus be ruled out. On the other hand, you will receive cryptographic certificates from the CAs or the certification authority. The fact that the certification system has fallen into disrepute is mainly due to the fact that numerous forged certificates were in circulation. This practice was observed at several certification authorities. As a result, there is now only limited trust in this model. However, the basic problem lies in the common browsers: they automatically trust that several hundred certification authorities issue legal certificates. The same applies to the subcertification authorities of the certification authorities. HTTP Public Key Pinning addresses exactly this issue and provides a remedy. The extension for pinning was largely created by Google employees. They used a comparatively simple mechanism to improve the security of their HTTPS certificates: A pin sent along with a website's HTTP header. These cryptographic keys are issued as hashes and have a time value. This ensures that browsers only accept connections where the certificate uses such pinning. Another interesting feature of pinning is that you can store a URL to which a message is sent if access is made via a faulty certificate. If the browser receives an HTTPS connection that has no pin as well as no matching certificate integrated, you will receive a JSON-encoded error report.