Suppose that my site is located at
foo.example.com and I send the following HTTP header when visitors accessing my site using HTTPS:
Strict-Transport-Security: max-age=31536000; includeSubDomains
Would the HSTS policy have any effect on domains such as
I'm not in charge of the certificates but the common name is
*.example.com on the certificate so I'm not sure if that matters.
The certificate isn't valid for
abc.foo.example.com, but I imagine that if there is a valid cert for such a host that the HSTS policy would apply there.