HPKP - HTTP Public Key Pinning Extension about ansible-pki HOT 3 OPEN

Just to clarify, HPKP needs a certificate file with full chain of intermediate certificates and root CA certificate included. This is done best in debops.pki role which currently handles for example combined key + certificate for certain applications. I'll add support for it with the role overhaul.

from ansible-pki.

https://bettercrypto.org also has a nice summary how this can be done. Also, no need to fear this feature. There is a Report-Only option which we could maybe even make the default (at least for LE as it is unlikely that people would use another CA if they use LE), not sure yet if https://report-uri.io/ supports that or if there are other services like this. So there is no excuse for not enabling this 😉
Edit: https://report-uri.io/ requires registration so it would be difficult to enable Report-Only by default unfortunately.

The requirements that @drybjed mentioned have been implemented by @drybjed in the meantime.

from ansible-pki.

For the record: OWASP about Certificate and Public Key Pinning and Transport Layer Protection Cheat Sheet with quite useful, practical/hands-on hints and checklists

from ansible-pki.