| created on | August 28, 2026 |
HPKP (HTTP Public Key Pinning) is an obsolete security mechanism defined in RFC 7469.
HPKP worked with the TOFU principle (Trust on First Use). The first time a browser visited a site, it received a Public-Key-Pins HTTP header containing SHA-256 hashes of SPKI (Subject Public Key Info). On later visits, the browser computed the SPKI fingerprints of the presented certificate chain. At least one of the presented public key hashes had to match the stored pin set. If it failed, the browser treated the error as non-recoverable and blocked the connection. Implementations required at least one active pin and one backup pin (not currently in use) to prevent lockouts during certificate renewals.
...