Public-Key-Pins

Deprecated
This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

Note: Public Key Pinning mechanism was deprecated in favor of Certificate Transparency and Expect-CT header.

The HTTP Public-Key-Pins response header used to associate a specific cryptographic public key with a certain web server to decrease the risk of MITM attacks with forged certificates, however, it has been removed from modern browsers and is no longer supported. Use Certificate Transparency and Expect-CT header instead.

For more information, see the HTTP Public Key Pinning article.

Header type Response header
Forbidden header name no

Syntax

Public-Key-Pins: pin-sha256="<pin-value>";
                 max-age=<expire-time>;
                 includeSubDomains;
                 report-uri="<uri>"

Directives

pin-sha256="<pin-value>"
The quoted string is the Base64 encoded Subject Public Key Information (SPKI) fingerprint. It is possible to specify multiple pins for different public keys. Some browsers might allow other hashing algorithms than SHA-256 in the future.
max-age=<expire-time>
The time, in seconds, that the browser should remember that this site is only to be accessed using one of the defined keys.
includeSubDomains Optional
If this optional parameter is specified, this rule applies to all of the site's subdomains as well.
report-uri="<uri>" Optional
If this optional parameter is specified, pin validation failures are reported to the given URL.

Example

HPKP has the potential to lock out users for a long time if used incorrectly! The use of backup certificates and/or pinning the CA certificate is recommended.

Public-Key-Pins:
  pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=";
  pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=";
  max-age=5184000; includeSubDomains;
  report-uri="https://www.example.org/hpkp-report"

In this example, pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=" pins the server's public key used in production. The second pin declaration pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=" also pins the backup key. max-age=5184000 tells the client to store this information for two months, which is a reasonable time limit according to the IETF RFC. This key pinning is also valid for all subdomains, which is told by the includeSubDomains declaration. Finally, report-uri="https://www.example.org/hpkp-report" explains where to report pin validation failures.

Specifications

Specification Title
RFC 7469, section 2.1: Public-Key-Pins Public Key Pinning Extension for HTTP

Browser compatibility

DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Public-Key-Pins
Deprecated
Chrome No support ? — 72Edge No support NoFirefox No support 35 — 72
No support 35 — 72
Full support 72
Disabled
Disabled From version 72: this feature is behind the security.cert_pinning.hpkp.enabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
IE No support NoOpera No support ? — 60Safari No support NoWebView Android No support NoChrome Android No support ? — 72Firefox Android Full support 35Opera Android No support ? — 51Safari iOS No support NoSamsung Internet Android No support ? — 11.0
report-uri
Deprecated
Chrome No support 46 — 72Edge No support NoFirefox No support No
Notes
No support No
Notes
Notes See bug 1091176.
IE No support NoOpera No support 33 — 60Safari No support NoWebView Android No support NoChrome Android No support ? — 72Firefox Android No support NoOpera Android No support 33 — 51Safari iOS No support NoSamsung Internet Android No support ? — 11.0

Legend

Full support
Full support
No support
No support
Deprecated. Not for use in new websites.
Deprecated. Not for use in new websites.
See implementation notes.
See implementation notes.
User must explicitly enable this feature.
User must explicitly enable this feature.

See also