2

I have configured Apache to return HSTS header. When connecting to https://lab20.example.com from Google Chrome and running with developer tools I can see the following response header: Strict-Transport-Security:max-age=63072000; includeSubdomains;

But it does not work. When I try to access the http://lab20.example.com, Chrome allows that.

Also when running from chrome: chrome://net-internals/#hsts Query domain "lab20.example.com" I receive "Response Not found".

Could anyone explain why this happens?

1
  • Enable hsts on server – mussdroid Aug 1 '16 at 7:35
9

For others who are seeing a similar issue - it may be because your browser has not yet accessed the site over HTTPS. Try accessing it over HTTPS and then again over HTTP. If HSTS is correctly implemented, then that last request should fail. MDN explains it nicely:

Note: The Strict-Transport-Security header is ignored by the browser when your site is accessed using HTTP; this is because an attacker may intercept HTTP connections and inject the header or remove it. When your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor the Strict-Transport-Security header.

2
  • 1
    Is there a reason for the down vote? Should this be a comment rather than an answer or something? – sfarbota Jul 30 '17 at 14:46
  • 1
    I don't understand the downvoting. I also had the same issue and it was not obvious for me that it doesn't work over http: unless I read your answer. – ernesto che Sep 25 '17 at 8:56
0

Did you configure your site config so that Apache forces SSL on all subdomains, not just example.com and www.example.com?

Also I believe that the chrome://net-internals/#hsts only shows correct queries from sites that are preloaded and added via https://hstspreload.appspot.com/ . This explains why chrome://net-internals/#hsts doesn't work for you.

4
  • I have only one domain: lab20.example.com with virtualhost for port 80 and another virtualhost for port 443 with HSTS enabled. And yes - as you can see in the header " includeSubdomains;" (my web browser is getting a correct header in the response when asking for lab2.example.com via https). So why that is not working, tested with Chrome 47 and 52 (47 might not work as per caniuse.com/#feat=stricttransportsecurity) – user2913139 Aug 1 '16 at 7:16
  • Hmm, I am not too sure. I would add so that all requests on lab20.example.com:80 redirects to lab20.example.com:443 (wiki.apache.org/httpd/RedirectSSL). Also, if you only need HSTS for the specific subdomain you could try removing includeSubdomains and just placing the HSTS header on the subdomain. Another thing, it might be stupid but I would set 'includeSubDomains instead of 'includeSubdomains'. – isdf Aug 1 '16 at 7:29
  • 1
    OK, i have fixed it. The problem was that i had no CA in chrome trusted store. Added exception manually. It looks like for such a scenario chrome does not honor HSTS headers. Once added CA to the trusted store everything is working fine - i also see my domain in chrome://net-internals/#hsts. Thanks ! – user2913139 Aug 1 '16 at 7:34
  • @user2913139 is this still true? Then it should be posted as an answer. – David Balažic Aug 14 '19 at 14:39
0

This might be because your PC has NO-SSL enabled or forced. If you can't disable NO-SSL, then your PC might not support disabling of NO-SSL.

0

Hsts does not work on a domain with invalid certificate.

Sounds reasonable, as it makes no sense to force https with a certificate that is not valid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.