Home / server / Questions / 810044
Accepted
Geremia
Asked: 2016-10-20 07:59:00 +0800 CST

How to log clients' HPKP errors in Apache?

  • 772

Is it possible to log clients' HPKP errors in Apache? It would seem this would be logged in in the error_log or ssl_request_log, but even when I set LogLevel debug, I don't see anything regarding pinning errors. Am I missing something?

logging

1 Answers

  1. Best Answer

    Use report-uri:

    Use this in Apache:

    Header always set Public-Key-Pins "report-uri=\"http://example.site/pkp-report.pl\" pin-sha256=\"<EXAMPLEPIN>\";  max-age=5184000; includeSubDomains"

    where the Perl script simply redirects the POST data to a log file:

    #!/usr/bin/perl

use strict;
use warnings;

use CGI;

open(my $outfh, ">>", "report-uri.txt") || die "can't open log file: $!";

while (<>) {
   print $outfh $_;
}

close($outfh);

print header();

    For HPKP, http://example.site/pkp-report.pl must be different from the HTTPS site that uses HPKP. For CSP reporting, it can be the same.

    • 0