system certificate hpkp

Use this command to configure a HTTP Public Key Pinning (HPKP) rule.

HPKP is a security feature in which FortiWeb inserts a cryptographic public key in server responses that clients then use to access a server. HPKP prevents attackers from carrying out Man in the Middle (MITM) attacks with forged certificates.

To use this command, your administrator account’s access control profile must have either w or rw permission to the admingrp area. For details, see Permissions.

Syntax

config system certificate hpkp

edit <hpkp_name>

set max-age <integer>

set pin-sha256 <base64_pin>

set report-only {enable | disable}

set report-uri <report_url>

set subdomains {enable | disable}

next

end

Variable	Description	Default
<hpkp_name>	Enter a name for the HPKP profile. You will use this name to select the profile in other parts of the configuration. The maximum length is 63 characters.	No default.
max-age <integer>	Enter an interval in which the client will use the SPKI fingerprint to attempt to access the server. The valid range is 0–31536000; the default value is 1296000. If you enter a value of 0, the cached pinning policy information will be removed.	1296000
pin-sha256 <base64_pin>	Enter a Base64 encoded SPKI fingerprint. Enter at least two pins, and at most five pins. At least one pin serves as a backup and must not refer to an SPKI fingerprint in a current certificate chain.	No default.
report-only {enable | disable}	Enable so that FortiWeb will send reports to the specified report-uri, if any, and allow the client to connect to the server when there is a pin validation failure. Disable so that FortiWeb will send reports to the specified report-uri, if any, and prevent the client from connecting to the server when there is a pin validation error.	enable
report-uri <report_url>	Enter a URL that FortiWeb will send pin validation failures to.	No default.
subdomains {enable | disable}	Enableto apply the public key pinning rule to all of the server's subdomains.	disable

Example

This example creates a public key pinning profile called hpkp_1 with two pins.

config system certificate hpkp

edit hpkp_1

set max-age 1296000

set pin-sha256 cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs= M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=

set report-only disable

set report-uri https://www.example.org/hpkp-report

set subdomain enable

next

end

Related topics

• server-policy policy
• server-policy server-pool