Keys are properly pinned here

1. Close the browser

2. Remove all mentions of fripost.org in ~/.mozilla/firefox/<profile>/SiteSecurityServiceState.txt:

   ~$ sed -i -r ‘/^(+.)?fripost.org:/d’ ~/.mozilla/firefox//SiteSecurityServiceState.txt

3. Start the browser (without HSTS or HPKP knowledge for fripost.org or any of its subdomains)

4. Open https://mail.fripost.org/ in a new tab

5. (After waiting a few seconds to let firefox flush the data.) The HSTS policy and the two pins appear in the file:

   ~$ grep -E ‘^(+.)?fripost.org:’ ~/.mozilla/firefox//SiteSecurityServiceState.txt mail.fripost.org:HSTS 0 16898 1475812232563,1,1 mail.fripost.org:HPKP 0 16898 1460047832565,1,0,SHfniMEapxeYo5YT/2jP+n+WstNaYghDMhZUadLlPDk=/Tt92H3ZkfEW1/AOCoGVm1TxZl7u4c+tIBnuvAc7d5w=

   There is no warning in the log, either.

The root CA (DST Root CA X3) appear in Firefox’s CA store as a “Builtin Object Token”, while the intermediate CA (Let’s Encrypt Authority X3) is supplied by the server and automatically stored by Firefox as a “Software Security Device”.

Do you have default settings for the security.cert_pinning.* tunables?

security.cert_pinning.enforcement_level = 1
security.cert_pinning.process_headers_from_non_builtin_roots = false

Please also verify that you have no weird non-default tunables for security.*.

I looked into it a bit more and it seems that it’s a bug in Firefox in fedora (something to do with the nss library being different).

Sorry about the noise.