Very quick question: If I enable HSTS, then lose access to the private key, what happens to clients? Do I just need to provision a new key on the same domain, or do clients pin the key?

@Tinned_Tuna My guess is provision the new key

Almost always this is the case when the key is lost

As normally there's no way to recover it, and no 3rd party stores it

@Aria That's fine, but HSTS doesn't imply any form of key pinning, right?

That is, clients aren't going to freak out seeing a different key.

OK so if you do not have private key then you can't run the any encyption at all so you always need some sort of private key

and then when you re-issue the cert which is similar (e.g. same authority, same signing etc), then it should work no issues

And for HSTS you will need also a backup key as well so they are both pinned

This is the case when the hash of your cert is hardcoded into the browser for example

I think HSTS would protect against MITM where real certificate is issued

I mean the key pinning would protect

the backup is for the reason of being able to quickly recover the service if the key is lost or unusable

developer.mozilla.org/en-US/docs/Web/Security/…

Note: The current specification requires including a second pin for a backup key which isn't yet used in production. This allows for changing the server's public key without breaking accessibility for clients that have already noted the pins. This is important for example when the former key gets compromised.

So the solution is to use two keys... and if both are lost, then the website is not working ;-)

Isn't that HPKP, not HSTS?

HSTS says that no HTTP is permitted

This is partly why I'm a little confused, my reading of the specs indicates that HSTS and HPKP are separate. HSTS just makes sure that the connection is over TLS, where as HPKP makes sure that an expected public key is seen. However, a few places seem to use HSTS and pinning as if you can't get one without the other.

HPKP prevents MITM attacks

So, one could reasonably deploy HSTS without HPKP and not require a back up/offline key in case of loss or compromise?

@Tinned_Tuna HPKP would not be 100% safe if client could be presented with plain HTTP

For example consider following attack:

Server -> Hacker with Fake Cert but valid -> Browser - HPKP will prevent this because Fake Cert is not matching pinned one

That would be rather this

Server -> TLS -> Hacker with Face Cert but valid -> TLS -> Browser - so HPKP prevents MITM

But also this would be possible without HSTS

Server -> TLS -> Hacker -> Browser - stripping out the TLS

So HSTS prevents TLS from being stripped

So that's why both are used at the same time

@Aria Good, cheers :-)

Some highly inspiring music video for the day

My darkometer scores 10/10 and it's the video not the original painting used

@Tinned_Tuna You are correct. You can use HSTS without HPKP. I do for my site, because I can't be bothered.

@Xander thanks :-)

OK some more inspiring music for today