Resolved Implementing HTTP Public Key Pinning on Plesk/Onyx

[Chrisa]

Is it possible to implement HTTP Public Key Pinning on Plesk/Onyx?

Plesk Onyx v17.5.3_build1705170317.16 os_Ubuntu 16.04

Support HPKP

Thanks

 

[UFHH01]

Hi Chrisa,

currently, the feature request is not very popular, as you can see at your linked Feature Request - page.

If you desire to discuss feature requests for Plesk, pls. open a thread at

=> Home > Forum > Plesk Discussion > Plesk Suggestions and Feedback​

 

[Chrisa]

Hi UFHH01,
Are you saying that it's not possible to implement HTTP Public Key Pinning on Plesk/Onyx?

Thanks

 

[UFHH01]

Hi Chrisa,

you may add as many additional headers for your domain(s), that you wish to. For such ( unique ) configurations, you have the option to use "Additional directives" over your Plesk Control Panel, at :

=> HOME > Subscriptions > YOUR-DOMAIN.COM > Apache & nginx Settings​

 

[Chrisa]

Hi UFHH01,
Is there any documentation available to help accomplish this task?
Thanks

 

[UFHH01]

Hi Chrisa,

no, there is no official Plesk documentation to achieve your goal.
But you could use the link at the feature request ( => HPKP: HTTP Public Key Pinning ) in addition with the Plesk documentations:

=> Adjusting Apache Settings for Virtual Hosts
=> Adjusting nginx Settings for Virtual Hosts​

... to inform yourself about the steps to go.

 

[Chrisa]

Hi UFHH01,
Thanks. I did see Scott's detailed instruction but wasn't sure if they would apply to a plesk implementation.

 

[bkhayes]

I do not recommend using HPKP in your Plesk instance.

Sources:
Google: Chrome is backing away from public key pinning, and here's why | ZDNet
HPKP is deprecated. What now? - Tim De Grande
The death knell for HPKP?
I'm giving up on HPKP
Be Afraid Of HTTP Public Key Pinning (HPKP)
Chrome 68 is depcrecating HPKP (HTTP Public Key Pinning) - Raymii.org
Security Researchers Lose Faith in HTTP Public Key Pinning - The New Stack
Google Deprecates Support for HTTP Public Key Pinning (HPKP)

 

[Heinrich]

If HPKP is activated in PLESK Obsidian it seems it sets it's own report uri.
How can I change that to mine ?