SSL and TLS

HTTPS

HSTS - HTTP Strict Transport Security

• HSTS at Wikipedia (English)
• HSTS at Wikipedia (German)

HPKP - HTTP Public Key Pinning

A helpful script to create the hashes was made by Hanno Böck and is accessible at Github.

I added a create option which makes the script more comfortable for me at Github, too.

The public key pins for this site are created like this:

# /etc/apache2/ssl/hpkp-gen.sh create DE Hamburg Hamburg lars.timmann.de   
Generating RSA private key, 4096 bit long modulus
..............................++
..........................................++
e is 65537 (0x10001)
Generating RSA private key, 4096 bit long modulus
...................................................................................................................++
.......................................................++
e is 65537 (0x10001)
Header always set Strict-Transport-Security "max-age=31556926;"
Header always set Public-Key-Pins "max-age=5184000; pin-sha256=\"i38qmLX9VLKCmH4XNvctxbv+ogiJXHtdPA/6RvvuJHE=\";pin-sha256=\"Oh+mTGIdu9+uughG5M1W6pCBRO5Ukja5MOzcl4qxKKw=\";pin-sha256=\"i38qmLX9VLKCmH4XNvctxbv+ogiJXHtdPA/6RvvuJHE=\";"

At the end you get one line for adding Strict-Transport-Security and one for Public-Key-Pins. Both in Apache format.

<VirtualHost lars.timmann.de:443>
    ...
    SSLEngine On
    SSLProtocol all -SSLv2 -SSLv3
    SSLCompression off
    SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
    SSLCertificateFile    /etc/apache2/ssl/timmann.de-wildcard.pem
    SSLCertificateKeyFile /etc/apache2/ssl/timmann.de.ec-key
    Header always set Strict-Transport-Security "max-age=31556926;"
    Header always set Public-Key-Pins "max-age=5184000; pin-sha256=\"sEQMIUbXSCbQQAMcCH7712u+cYCjFITlUSH/C1DEGHY=\";pin-sha256=\"9f3SRITO2UNdpnurhfJGLZqcaXJBUm3WRKRIKYiPARc=\";pin-sha256=\"sEQMIUbXSCbQQAMcCH7712u+cYCjFITlUSH/C1DEGHY=\";"
    ...
</VirtualHost>

You need to enable the headers module in Apache. On Ubuntu just do:

# sudo a2enmod headers