https://bjornjohansen.com/tag/certificate-pinning/ Recent content in certificate-pinning on {bjørn:johansen} Hugo -- 0.118.2 en-US Thu, 16 Jul 2015 11:39:19 +0000 https://bjornjohansen.com/public-key-pinning/ Thu, 16 Jul 2015 11:39:19 +0000 urn:uuid:36656436-3236-5036-a238-646136336161 <a href="https://www.bjornjohansen.com/securing-nginx-ssl">Using HTTPS</a> helps preventing someone from snooping your username/password or hijacking your sessions. <a href="https://www.bjornjohansen.com/optimizing-https-nginx">Using HSTS</a> makes sure the connection stays on HTTPS, even if a MITM tries to redirect you to the plain HTTP version of a web site. But it is easier than you might think for a MITM to use a rogue certificate, making you believe everything is fine. HTTP Public Key Pinning (HPKP) helps the browser check that everything actually is fine.