Re: [websec] HSTS: pinning certs, other changes to TLS server authentication

[Tobias Gondrom <[e-mail]>]

Hm, using a http header makes pinning a cert quite difficult, plus you
still have the trust on first use.
However HSTS is easy to deploy and will give improved security quickly
(even without the pinning).

As has been mentioned on the list earlier, there are considerations for
association of cert with protocol and domain using DNSSEC - though this
is a complicated matter.
Please take a look at dane: https://datatracker.ietf.org/wg/dane/charter/

BR, Tobias



On 03/24/2011 03:54 AM, Matt McCutchen wrote:
> On Wed, 2011-03-23 at 20:36 -0700, Adam Barth wrote:
>> Thanks for forwarding the thread.  There have been a bunch of people
>> asking for the ability to pin a certificate (or a CA certificate)
>> using HSTS.  In light of recent events, that's sounding more and more
>> like something we should consider.
> Maybe.  Pinning certs is a stopgap; it obviously doesn't work on the
> first connection, and it places potentially significant operational
> constraints on the web site.  I have a hard time seeing it as a step
> toward a coherent server authentication scheme that solves the problems
> we are facing today.  But it may be a useful thing to do in light of the
> typical temporal and spatial scope of MITM attacks.  (Can anyone comment
> on this?)
>