On Sun, Feb 21, 2016 at 11:23:02AM +0200, Thierry wrote: Hi there,
> After I have executed the curl command, it seems that I have an answer > from my Apache2 back end server (apache2.conf) > Yes I do see the "Public-Key-Pins:" line... And yes I do have the > content that I expect. That's good. How do you know what content to expect? > Public-Key-Pins: > pin-sha256="DZNsRcNIolhfdouihfazormhrfozef=";pin-sha256="633ltusrlsqhoagfdgfo79xMD9r9Q="; > max-age=2592000; includeSubDomains What is the actual sha256 of the certificate that the browser receives? Is it one of the two above? The details are in RFC7469. https://tools.ietf.org/html/rfc7469#appendix-A gives an example of how you mind find it. > But, is it really the output of Apache2 ? There is a syntax difference > between Nginx and Apache2: Should it be the output of Apache2? Your browser is speaking https to nginx. It should only see the pinning information from nginx. The browser never sees the Apache certificate, and so should not see anything related to it. > Nginx: pin-sha256="DZNsRcNIoiVdK8Img794j8/XGf4+6sDLFjADPWWOddw="; > Apache2: pin-sha256=\"DZNsRcNIoirupeqrhfjpzehfrhfaefhpazf=\"; I suspect that only one of those is valid in the response header. https://tools.ietf.org/html/rfc7469#section-2.1.5 suggests that the backslashes are unnecessary. (Note that neither of those sha256 values match the ones in the response header. What is actually written in your nginx.conf, and what is the actual response you get from curl? If they are different, you have more investigating to do.) > When the curl command return me the result, I can see that there is > no "\" ... Is it normal ? I think "yes". > If yes, why is "ssllabs.com/ssltest" doesn't see anything concerning > the HPKP ? Is there any documentation on the ssllabs.com site about what they are testing? Can you see, does "HPKP: No" distinguish between: * no Public-Key-Pins header returned * Public-Key-Pins header found, but with invalid formatting * valid Public-Key-Pins header found, but without the sha256 of the current certificate Good luck with it, f -- Francis Daly [email protected] _______________________________________________ nginx mailing list [email protected] http://mailman.nginx.org/mailman/listinfo/nginx
