security headers Strict-Transport-Security available for http?

Question

I'm reading the list of useful header from OWASP and I've some trouble understanding if the first two require an HTTPS certificate ?

• Public Key Pinning Extension for HTTP : The Public Key Pinning Extension for HTTP (HPKP) is a security header that tells a web client to associate a specific cryptographic public key with a certain web server to prevent MITM attacks with forged certificates.

• Strict-Transport-Security : HTTP Strict-Transport-Security (HSTS) enforces secure (HTTP over SSL/TLS) connections to the server. This reduces impact of bugs in web applications leaking session data through cookies and external links and defends against Man-in-the-middle attacks. HSTS also disables the ability for user's to ignore SSL negotiation warnings.

Answer 1

HTTP Public Key Pinning(HPKP) is a trust on first use technique. When a user requests a web server for the first time, the server tells to pin its own or an intermediate CA's public key to the browser via a special HTTP header. After that browser stores this key for a given period of time. Upon user's subsequent requests for that web server, the browser expects to contain the pinned key inside one of certificates in the certificate chain of the web server. If not, the user is blocked by giving a warning. For more information you can refer Implementing and Testing HTTP Public Key Pinning (HPKP)

Answer 2

Yes they both do require a certificate:

• The first one pin a list of certificates. One of the must be in the current certificate chain.
• The second one force to use https if the current https connection is valid.

So by definition the first one need https and a certificate, and the spec of HSTS forbid to send the header with http connections.