3 ms·
You can't set a misconfigured policy over http, it needs to be HTTPS with a valid CA.
by mkj 10y ago
You can't set a misconfigured policy over http, it needs to be HTTPS with a valid CA.
- niftich 10y agoThat's not entirely clear from the spec. Per section 11.3 [1], if HTST policy is enabled with a self-signed cert, then "then secure connections to that site will fail, per the HSTS design". In my reading, it doesn't say that a compliant user-agent must not set HSTS policies for self-signed certs; rather, it says a compliant user-agent will show an un-remediable error upon attempt to visit the website. [1] https://tools.ietf.org/html/rfc6797#section-11.3 https://tools.ietf.org/html/rfc6797#section-11.3
- icebraining 10y agoRegardless of spec, none of the major browsers accept HSTS policies from sites with self-signed certs.