4 ms·
That's not entirely clear from the spec. Per section 11.3 [1], if HTST policy is enabled with a self-signed cert, then "then secure connections to that site wil
by niftich 10y ago
That's not entirely clear from the spec. Per section 11.3 [1], if HTST policy is enabled with a self-signed cert, then "then secure connections to that site will fail, per the HSTS design".
In my reading, it doesn't say that a compliant user-agent must not set HSTS policies for self-signed certs; rather, it says a compliant user-agent will show an un-remediable error upon attempt to visit the website.
[1] https://tools.ietf.org/html/rfc6797#section-11.3 https://tools.ietf.org/html/rfc6797#section-11.3
- icebraining 10y agoRegardless of spec, none of the major browsers accept HSTS policies from sites with self-signed certs.