Hacker News Reader

> I'd expect I'm not the only one who wants to pin few certs for sites that I visit frequently.

How can you tell what the backup pin for those websites would be without the owner publishing the HKPK headers? How do you know the max-age of their current pin?

It sound a bit like trying to stuff things into the browser's cache - a road to disaster.

View on HN

I control these sites.

If you control the sites, just modify their server configuration so they send the HPKP header.

If you don't control the sites, it is not a good idea to pin them "from the browser" as you suggest.

You can get their certs pinned into your browser by adding the HKPK header to them. It'll also mitigate risks for your other visitors (if any; may not be a public site).

Reply on news.ycombinator.com