5 ms·
HSTS has largely solved what you are referring to.
by asdfaoeu 11y ago
HSTS has largely solved what you are referring to.
- gmac 11y agoYes — I wonder if Let's Encrypt sets this up by default.
- LunaSea 11y agoIsn't set HSTS at the web application level rather than the SSL / TLS certificate registrar level ?
- bjacobel 11y agoCorrect, HSTS is a header that is passed by nginx/Apache/whatever combined with a hard coded list shipped with your browser. You need SSL for HSTS to work, but the SSL vendor you choose doesn't have any bearing on being able to implement HSTS.
- schoen 11y agoA feature that we were considering is enabling HSTS (in the Secure mode) and gradually increasing the max-age over time, so that if something went wrong at the outset the administrator would be able to reverse the process without affecting clients for very long (perhaps starting with a one hour max-age, then doubling the max-age on every subsequent day?).