# Making LetsEncrypt work with HPKP and leaf-pinning

**URL:** https://cog.discourse.group/t/making-letsencrypt-work-with-hpkp-and-leaf-pinning/1329
**Category:** blog
**Created:** [June 11, 2017, 8:21pm UTC](https://cog.discourse.group/t/making-letsencrypt-work-with-hpkp-and-leaf-pinning/1329 "2017-06-11T20:21:44Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![BigDinoBlog](https://sea1.discourse-cdn.com/flex001/user_avatar/cog.discourse.group/bigdinoblog/32/417_2.png) [@BigDinoBlog](https://cog.discourse.group/u/BigDinoBlog)
#### Post date: [June 11, 2017, 8:21pm UTC](https://cog.discourse.group/t/making-letsencrypt-work-with-hpkp-and-leaf-pinning/1329/1 "2017-06-11T20:21:44Z")

</div>

> Public key pinning is scary. The technology’s purpose is to allow website owners to include a cryptographic fingerprint in outgoing HTTP headers that corresponds with the fingerprint of the server’s certificate; if the fingerprint in the headers doesn’t match the actual fingerprint, it could be evidence that something nefarious is going on. You might be the victim of a MITM attack, or the site might have been compromised, or you might be accessing a fake version of the site that has a legitimate (but falsely-issued) SSL/TLS certificate.

> The scary part is that as with [HSTS](https://blog.bigdinosaur.org/how-to-cache-https-with-varnish-using-haproxy/), a mistake with your HPKP configuration can make your site unreachable—potentially for a long time.

> ## So why the hell do it?

Security researcher Scott Helme has [some in-depth thoughts on HPKP](https://scotthelme.co.uk/hpkp-http-public-key-pinning/), as does [SSL Labs’ Ivan Ristic](https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-dead). The short version is that HPKP provides a significant amount of protection against a number of different potential attacks. The problem is that it does so with a pretty heavy hand; browsers presented with mis-matched HPKP fingerptints will block the display of a site for as long as the HPKP header has instructed them to, and that period of time might be weeks, months, or years. A misconfigured HPKP header will ruin potentially a lot more than just your day.

> In spite of the scariness, HPKP is a useful thing to implement—it’s just got to be done right. Personally, I decided to push forward with my own HPKP setup for the same reason that I usually jump head-first into stuff like this: just like jumping head-first into a cold swimming pool, it’s best to get it over with.

[Read the rest of this blog entry…](https://blog.bigdinosaur.org/making-letsencrypt-work-with-hpkp-and-leaf-pinning/)