Not sure you will see this as your question is a couple days old now, but it is possible to create one or more backup keys &amp; CSRs to use to generate a second hash. When you say <i>&quot;I don&#x27;t have my next certificate yet&quot;</i> you should know that you don&#x27;t need it, that&#x27;s perfectly fine.<p>You would include the fingerprint of the second CSR along with the fingerprint of your current certificate in the header, and then if you ever need to change certs you generate a new one from that same second key &amp; CSR.<p>Scott Helme&#x27;s blog post here walks you through the steps and provides examples: <a href="https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;hpkp-http-public-key-pinning&#x2F;" rel="nofollow">https:&#x2F;&#x2F;scotthelme.co.uk&#x2F;hpkp-http-public-key-pinning&#x2F;</a><p>Hope that helps!