off-the-clock.md

key pinning

1. Use csplit to split the full chain.

   $ csplit -f cert- /etc/letsencrypt/live/path/to/fullchain.pem '/-----BEGIN CERTIFICATE-----/' '{*}'

2. Get the hashes from the parts

   $ openssl x509 -noout -in cert-00 -pubkey | openssl rsa -pubin -outform der |openssl dgst -sha256 -binary | base64

3. Update nginx headers

   add_header Public-Key-Pins 'pin-sha256="xDzXdAop5winlAbC7dqKey6pJyaV7Sk+wbSOx8z49cE="; pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="; max-age=5184000; includeSubDomains';