You are not logged in.

#1 2015-02-23 15:39:41

Registered: 2015-02-23
Posts: 1

HPKP broken system-wide?

Visiting pins the valid certs for the domain incl all sub-domains. So trying to open should end in a browser error. On Win 7 and Ubuntu 14.04 that actually works: Firefox tells me:

Secure Connection Failed

An error occurred during a connection to The server uses key pinning (HPKP) but no trusted certificate chain could be constructed that matches the pinset. Key pinning violations cannot be overridden. (Error code: mozilla_pkix_error_key_pinning_failure)
• The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
• Please contact the website owners to inform them of this problem.


Unfortunately on Arch, Firefox and Chromium/Chrome do load without complaining, i.e. you are not protected against certain MITM attacks. How can this be fixed?


#2 2015-03-05 14:20:39

From: Netherlands, Europe
Registered: 2005-10-04
Posts: 8,222

Re: HPKP broken system-wide?

Looks like all arch browsers have that problem, check FS #43971

Multi-init booting with apg Openrc and systemd coexisting
Automounting : not needed, i prefer pmount
Aur helpers : makepkg + my own local repo === rarely need them


Board footer

Powered by FluxBB