The application I'm working on is accessible only via IP address, so HTTPS connection is provided via a custom-signed certificate.
I explained to my client that (from MDN docs)
[...] when your site is accessed over HTTPS with no certificate errors, the browser knows your site is HTTPS capable and will honor the Strict-Transport-Security header.
it therefore does not work with self-sigend certificate, but he wants it anyway because of (quoting) "security reasons".
Does the HSTS header have any usefulness in case of self-signed certificates?