Public-Key-Pins test

This page allows online testing of browser (or web firewall, if SSL decrypting firewall is used) support for Public Key Pinning Extension for HTTP (HPKP) and HTTP Strict Transport Security (HSTS).

About Public key pinning and HPKP

Public key pinning and Public Key Pinning Extension for HTTP (HPKP) sections of Public-Key-Pins calculator page briefly describe these technologies, how they work and how they make HTTPS/SSL/TLS connections more secure.

Deprecation

HPKP has been removed in Chrome 72 and Firefox 72.

On Firefox 72 - 77 it was possible to re-enable HPKP by manually setting security.cert_pinning.hpkp.enabled about:config setting to true. In Firefox 78 HPKP has been completely removed (security.cert_pinning.hpkp.enabled has no effect on Firefox 78 and later).

Browser compatibility test

Automatic test results for browser visiting this page:

More precise manual testing

• Public Key Pinning Extension for HTTP test page will open page only upon failure or will show non-bypassable browser error (stating that verification of certificate hash has failed) upon success. This test works by opening a page on subdomain whose certificate public key is not pinned via Public-Key-Pins HTTP header sent by this page.

• HTTP Strict Transport Security (HSTS) test page will open page showing whether browser side redirection from HTTP to HTTPS has happened. This page works by using two different HTML files - success message available via HTTPS and failure message available via HTTP - and linking to failure message.

• HTTP Strict Transport Security (HSTS) No User Recourse test page will show non-bypassable browser error (about invalid certificate) upon success or will display regular/bypassable browser error upon failure. This test works by opening a page on subdomain whose certificate is considered invalid (with mismatched name), but has correctly pinned public key (actually certificate of this site).

Direct test links

These links can be used to detect browser bugs in Public Key Pinning Extension for HTTP and HTTP Strict Transport Security (HSTS) implementations in specific conditions (e.g. when address is typed after re-opening browser, added to favorites, set as homepage, opened by restoring session etc.). These addresses can be used only after visiting https://projects.dm.id.lv/. Upon success both of these addresses will show non-bypassable browser errors.

• https://pkptest.projects.dm.id.lv/ is direct address of Public Key Pinning Extension for HTTP test page. It will open page only upon failure or it will show non-bypassable browser error (stating that verification of certificate hash has failed) upon success.

• http://hststest.projects.dm.id.lv/ (please note "http://" without "s") is direct address of HTTP Strict Transport Security (HSTS) (including No User Recourse) test page. It will open page (or bypassable error/warning) only upon failure or it will show non-bypassable browser error (about invalid certificate) upon success. This address tests HSTS and HSTS No User Recourse, so bypassable error/warning means that only No User Recourse is not supported.

Test results for some well known browsers

This table shows test results for some popular web browsers (two results marked with * are not test results, but data taken from documentation):

Related browser security tests

Here are links to some third party browser SSL/TLS tests. They can be used to test other security features of web browser.

• https://www.ssllabs.com/ssltest/viewMyClient.html - online browser test which analyzes various SSL/TLS (and related) features.
• https://badssl.com/ - various online SSL/TLS browser tests.
• https://www.grc.com/revocation.htm - online browser test which checks for acceptance of revoked certificates.