How to implement HPKP in a Spring Boot application?

Viewed 230

I would like to implement HPKP in my applications. I have 2 spring boot application, the server runs on https://localhost:9999 and the client tries to reach the https://localhost:9999/test.

I would like to pin the public key.

I found this: https://docs.spring.io/spring-security/site/docs/4.2.x/reference/html/headers.html#headers-hpkp

I tried to find projects what implement HPKP but there are ZERO amount on the web. How do I need to change this code to make it work? Should I put it in the client or the server?

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                .headers()
                        .httpPublicKeyPinning()
                                .includeSubdomains(true)
                                .reportUri("https://example.net/pkp-report")
                                .addSha256Pins("d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=", "E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g=";
        }
}

My client application have a truststore that stores a CA certificate. With this CA certificate I signed and created a SERVER certificate. I set this certificate like:

Server:

application.properties

server.ssl.enabled=true
server.ssl.client-auth=none
server.ssl.key-store=keystore/server.jks
server.ssl.key-store-password=changeit

@Configuration
@RequiredArgsConstructor
public class SSLConfig {
    private final Environment env;

    @PostConstruct
    private void configureSSL() {
        System.setProperty("javax.net.ssl.keyStore", env.getProperty("server.ssl.key-store"));
        System.setProperty("javax.net.ssl.keyStorePassword", env.getProperty("server.ssl.key-store-password"));
    }
}

My client application just do a GET call on https://localhost:9999/test.

Client:

application.properties

client.ssl.trust-store=keystores/mycustom.truststore
client.ssl.trust-store-password=changeit

@Configuration
@RequiredArgsConstructor
public class SSLConfig {

private final Environment env;

@PostConstruct
private void configureSSL() {
    System.setProperty("javax.net.ssl.trustStore", env.getProperty("client.ssl.trust-store"));
    System.setProperty("javax.net.ssl.trustStorePassword", env.getProperty("client.ssl.trust-store-password"));
}
}

The documentation says: the client stores this information for a given period of time. Is the spring doing it automatically or am I supposed to extract this data and save it at the first time, then every time when I get a response from server check if it equals? (this would take a LOT of time and what if I forget somewhere to verify?)

Thanks in advance.

0 Answers
Related