3 ms·
This seems to be an edge case between how wildcard certificates work versus how HSTS works. Wildcard certs only validate one subdomain of depth (so *.foo.com c
by philip1209 11y ago
This seems to be an edge case between how wildcard certificates work versus how HSTS works.
Wildcard certs only validate one subdomain of depth (so *.foo.com cert does not validate a.b.foo.com). HSTS "includeSubDomains" will require a valid SSL cert for all recursive subdomains.
It's a problem, but I don't think it's a problem worth solving.