2

The application I'm working on is accessible only via IP address, so HTTPS connection is provided via a custom-signed certificate.

I explained to my client that (from MDN docs)

[...] when your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor the Strict-Transport-Security header.

it therefore does not work with self-sigend certificate, but he wants it anyway because of (quoting) "security reasons".

Does the HSTS header have any usefulness in case of self-signed certificates?

Improve this question
1
5

HSTS will not work with typical self-signed certificates, i.e. where the issuer is the certificate itself. But it will work with certificates issued by any CA provided that this CA is added as trusted to the browser. This means also that some private CA can be used to create the certificate in question as long as this private CA is added as trusted to the browsers.

Improve this answer
6
  • Just as an interesting anecdote, I was using a certificate signed for local host and a root CA trusted on my laptop at one point, to test HSTS. This back-fired big time later, as the HSTS restriction is not possible to override in Chrome the way an untrusted certificate is. HSTS is an amazing security feature, but should probably be used with caution if you're not very familiar with certificate management in general since there's no way around it for the user.
    – nbering
    Apr 13 '18 at 13:35
  • @nbering: It is an explicitly designed feature of HSTS that the average user is not able to override it so that users don't get tricked.
    – Steffen Ullrich
    Apr 13 '18 at 15:12
  • I agree with the feature. It’s good practice. But I also know a lot of small business developers who have trouble managing certificates and would get burned by this.
    – nbering
    Apr 13 '18 at 15:17
  • @nbering: Then lets hope that they get burned early during testing already and not in production. Actually, looking at the questions at stackoverflow.com many get already burned after they've added a 301 redirect (i.e. permanent redirect) to HTTPS and are now unable to revert this since the browser insists on the HTTPS site now.
    – Steffen Ullrich
    Apr 13 '18 at 15:31
  • 1
    @MarkoPacak: correct. It is not adding an exception for this specific certificate (which you cannot do with HSTS anyway) but explicitly trusting the CA which issued this certificate by adding it to the local trust store.
    – Steffen Ullrich
    Apr 14 '18 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.