ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN: Fix

• Site changed its SSL cert while the old HPKP pin is still valid
• Chrome static pin (built into the browser) does not match
• Corporate proxy with MITM cert not in the pin list
• Client was MITMed on a previous visit
• Broken HPKP header on the server (max-age too large)

1. Open chrome://net-internals/#hsts → Delete domain → enter your domain
2. Clear TLS state: chrome://net-internals/#sockets → Flush sockets
3. Remove HPKP from the server (deprecated since 2018): Public-Key-Pins: max-age=0;
4. For static pins (e.g. google.com, facebook.com) — only a Chrome update
5. Inspect the cert chain via SSL Checker to see the current chain

Check SSL Certificate →

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_stapling        on;
    ssl_stapling_verify on;
}

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN error occurs when a browser detects that a pinned SSL certificate does not match the certificate chain presented by the server. To resolve this issue, ensure that the correct public key is included in the certificate chain and that the server's SSL configuration correctly implements HTTP Public Key Pinning (HPKP). Use openssl s_client -connect yourdomain.com:443 -showcerts to inspect the certificates in use.

The NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN error is primarily associated with HTTP Public Key Pinning (HPKP), a security feature that allows web servers to specify which public keys are valid for a specific domain. If a browser encounters a mismatch between the pinned keys and the SSL certificate chain provided by the server, it will throw this error, blocking access to the site.

HPKP reduces the risk of man-in-the-middle attacks by ensuring that a browser only trusts certificates that are associated with specific public keys. However, this feature can lead to issues if not configured correctly. The following factors can contribute to this error:

• Expired or Revoked Certificates: If the pinned certificate has expired or been revoked, the browser will reject the connection.
• Incorrect Certificate Chain: If the server presents an incorrect certificate chain that does not include the pinned public key, the browser will flag it as an error.
• Misconfigured HPKP Headers: If the HPKP headers are not properly set or the keys are incorrect, this can lead to the error.

To troubleshoot the issue, you can use tools like openssl or online SSL checkers to verify the SSL certificate chain and confirm that the public keys match the pinned keys.

To resolve the NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN error, follow these practical steps:

1. Inspect the SSL Certificate: Use the following command to inspect the SSL certificate chain:

openssl s_client -connect yourdomain.com:443 -showcerts

This command will display the certificates in the chain. Verify that the public key of the pinned certificate matches one of the certificates in the chain.

1. Check HPKP Headers: Ensure that your web server is sending the correct HPKP headers. The headers should look something like this:

Public-Key-Pins: pin-sha256="base64=="; pin-sha256="base64=="; max-age=5184000; includeSubDomains

Replace the placeholders with your actual pinned keys. Make sure that the keys correspond to the public keys in your SSL certificate chain.

1. Update Certificate Chain: If there is a mismatch, update your server's SSL configuration to include the correct certificate chain. This may involve obtaining a new certificate from your Certificate Authority (CA) or reconfiguring your server settings.
2. Test the Configuration: After making changes, retest your SSL configuration using the openssl command or an online SSL testing tool. Ensure that there are no errors and that the correct keys are present in the chain.

By following these steps, you should be able to resolve the NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN error and ensure a secure connection for users accessing your site.