HPKP

created on

August 28, 2026

HPKP (HTTP Public Key Pinning) is an obsolete security mechanism defined in RFC 7469. HPKP worked with the TOFU principle (Trust on First Use). The first time a browser visited a site, it received a Public-Key-Pins HTTP header containing SHA-256 hashes of SPKI (Subject Public Key Info). On later visits, the browser computed the SPKI fingerprints of the presented certificate chain. At least one of the presented public key hashes had to match the stored pin set. If it failed, the browser treated the error as non-recoverable and blocked the connection. Implementations required at least one active pin and one backup pin (not currently in use) to prevent lockouts during certificate renewals. ...

CRL (Certificate Revocation List)

created on

August 26, 2026

A CRL (Certificate Revocation List) is a list of digital certificates that have been revoked by the issuing CA (Certificate Authority) before their scheduled expiration date and should no longer be trusted. ...

OCSP (Online Certificate Status Protocol)

created on

August 26, 2026

OCSP (Online Certificate Status Protocol) Instead of downloading –a potentially large– CRL, the client sends the certificate’s serial number to an OCSP responder. The OCSP responder replies with one of the status of good, revoked, or unknown. If it cannot process the request, it may return an error code. The details are outlined in RFC 6960 . ...