This error message suggests that the server in question was previously configured with a HTTP Public Key Pinning directive in the HTTP response headers demanding a certificate with a particular SubjectPublicKeyInfo in the certificate chain. https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning

Such directives are not respected by many browsers (https://caniuse.com/#search=hpkp), but were respected by Chrome 68 and earlier (Removal  Issue 779166 ). 

This server does not appear to be sending a Public-Key-Pins directive at this time, but simply removing the directive will not affect clients that had previously cached it.

Did your site previously send this header?

Yes, that’s correct.  Until a few weeks ago we were sending a Public-Key-Pins directive.

Is there some way we can get rid of the old cached pinning?  It’s obviously unsatisfactory for our subscribers to have to wait for weeks for caches to clear automatically so that they can access their subscription magazines.

Thanks.

Cheers, Brian
-----------------------------------------------------------------
Brian Loffler
Outreach Director - Eco-activism for a fair planet
marketing@newint.com.au <mailto:marketing@newint.com.au>
digital.newint.com.au <http://digital.newint.com.au/> 
ph 08 8232 1563
-----------------------------------------------------------------
Sign up for our email newsletters
- campaign updates
- latest stories from the New Internationalist magazine
www.newint.com.au/news <http://www.newint.com.au/shop/newsletter.htm> 
-----------------------------------------------------------------
Fresh ideas for a better world

New Internationalist Publications Pty Ltd ABN 11 005 523 124
172 Gilles St, ADELAIDE  SA   5000 (previously Austin St)
AUSTRALIA
Blog: http://www.newint.com.au/blog/ <http://www.newint.com.au/blog/>
Facebook: https://www.facebook.com/newint.au <https://www.facebook.com/newint.au> 
Twitter: https://twitter.com/newint_au 
Instagram: https://www.instagram.com/newint_au/ <https://www.instagram.com/newint_au/>
Tumblr: http://newintoz.tumblr.com <http://newintoz.tumblr.com/> 
Flickr: http://www.flickr.com/photos/ni-magazine/ <http://www.flickr.com/photos/ni-magazine/> 
Pinterest: http://www.pinterest.com/newintau/ <http://www.pinterest.com/newintau/> 
Google+: https://plus.google.com/+NewintAu <https://plus.google.com/+NewintAu> 
LinkedIn: http://www.linkedin.com/pub/brian-loffler/4/683/678 <http://www.linkedin.com/pub/brian-loffler/4/683/678>

It sounds like everything is working as expected then. 

The Public-Key-Pins header specifies how long it is valid for-- servers may request caching for up to 60 days (https://codereview.chromium.org/1733973004).

Individual users may remove pinning entries by visiting chrome://net-internals/#hsts

To fix this from the server side, you'll need to reprovision your server with a cert chain that contains a certificate with the pinned SPKI value.

Thank you.