{"action":"created","issue":{"url":"https://api.github.com/repos/shazow/urllib3/issues/607","labels_url":"https://api.github.com/repos/shazow/urllib3/issues/607/labels{/name}","comments_url":"https://api.github.com/repos/shazow/urllib3/issues/607/comments","events_url":"https://api.github.com/repos/shazow/urllib3/issues/607/events","html_url":"https://github.com/shazow/urllib3/issues/607","id":72214372,"number":607,"title":"HPKP","user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"milestone":null,"comments":10,"created_at":"2015-04-30T16:32:41Z","updated_at":"2015-04-30T20:38:38Z","closed_at":null,"body":"HPKP is cool, and I think we should be able to do it.\r\n\r\nThis issue tracks us (me?) spiking out how best to do it. I believe we can do it, and continue to be Python HTTP security wizards.\r\n\r\nPeople who may want to watch this issue: @sigmavirus24 @reaperhulk @dstufft @tiran.\r\n\r\n<bountysource-plugin>\r\n---\r\nWant to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/12612776-hpkp?utm_campaign=plugin&utm_content=tracker%2F192525&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F192525&utm_medium=issues&utm_source=github).\r\n</bountysource-plugin>"},"comment":{"url":"https://api.github.com/repos/shazow/urllib3/issues/comments/97959707","html_url":"https://github.com/shazow/urllib3/issues/607#issuecomment-97959707","issue_url":"https://api.github.com/repos/shazow/urllib3/issues/607","id":97959707,"user":{"login":"jpf","id":41538,"avatar_url":"https://avatars.githubusercontent.com/u/41538?v=3","gravatar_id":"","url":"https://api.github.com/users/jpf","html_url":"https://github.com/jpf","followers_url":"https://api.github.com/users/jpf/followers","following_url":"https://api.github.com/users/jpf/following{/other_user}","gists_url":"https://api.github.com/users/jpf/gists{/gist_id}","starred_url":"https://api.github.com/users/jpf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jpf/subscriptions","organizations_url":"https://api.github.com/users/jpf/orgs","repos_url":"https://api.github.com/users/jpf/repos","events_url":"https://api.github.com/users/jpf/events{/privacy}","received_events_url":"https://api.github.com/users/jpf/received_events","type":"User","site_admin":false},"created_at":"2015-04-30T20:38:38Z","updated_at":"2015-04-30T20:38:38Z","body":"Here is the code that I wrote to a small part of HKPK pinning, it was written with the eventual goal of being part of a full HKPK solution: https://github.com/okta/okta-openvpn/blob/master/okta_openvpn.py#L64\r\n\r\nThe example above is part of public pubic release written for my employer. The tags on the repository are signed using my public key. The repository also comes with a full suite of tests, the file [test_ssl_public_key_pinning.py](https://github.com/okta/okta-openvpn/blob/master/tests/test_ssl_public_key_pinning.py#L1) has the tests which exercise my key pinning code. \r\n\r\nI also just ported the key pinning code above to use cryptography instead of M2Crypto, my tests pass but I haven't updated the repository yet, so the code is in this Gist: https://gist.github.com/jpf/ad9ae5dea9556fa31d81#file-okta_openvpn-py-L67\r\n\r\nNote that all my code *only implements verification of the public key of the leaf certificate* against a pre-loaded \"pinset\". In addition to the things mentioned above about pin storage, what is notably missing from my example are:\r\n* Checking the public keys of the entire certificate chain.\r\n* Parsing of [HKPK pin directives](https://tools.ietf.org/html/rfc7469#section-2.1.1).\r\n* [Reporting pin validation failures](https://tools.ietf.org/html/rfc7469#section-3)."}}