HSTS/PKP

HSTS is HTTP Strict Transport Security: a way for sites to elect to always use HTTPS. See https://www.chromium.org/hsts. PKP is Public Key Pinning: a way for sites to "pin" themselves to particular public keys that must appear in their certificate chain. See https://tools.ietf.org/html/rfc7469.

Add HSTS/PKP domain

Input a domain name to add it to the HSTS/PKP set:

Domain:



(public key fingerprints are comma separated and consist of the hash function followed by a foreslash and the base64 encoded fingerprint, for example sha256/7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=)

Query HSTS/PKP domain

Input a domain name to query the current HSTS/PKP set:

Domain:

Expect-CT

Expect-CT allows sites to elect to always require valid Certificate Transparency information. See https://tools.ietf.org/html/draft-ietf-httpbis-expect-ct.

Add Expect-CT domain

Input a domain name to add it to the Expect-CT set. Leave Enforce unchecked to configure Expect-CT in report-only mode.

Query Expect-CT domain

Input a domain name to query the current Expect-CT set:

Send test Expect-CT report

Trigger a test report to the given report URI. The report will contain a hostname of "expect-ct-report.test" and dummy data in other fields.

Delete domain security policies

Input a domain name to delete its dynamic domain security policies (HSTS, HPKP, and Expect-CT). (you cannot delete preloaded entries):