We have a website www.example.com with a certificate for domain www.example.com, we also have HSTS enabled. The Qualys SSL Labs (https://www.ssllabs.com/index.html) confirmed that HSTS has been enabled.
I noticed that if you go to https://test.example.com (which is served by the same Web Server), you encounter a certificate error, which is to be expected, as there is no certificate for test.example.com loaded on the Web Server. However, I have noticed that you can click through the certificate errors, and the web content is then served.
To me this is unexpected behavior. I thought that one of the central ideas behind HSTS is that you cannot click through certificate errors. From Wikipedia: "If the security of the connection cannot be ensured (e.g. the server's TLS certificate is not trusted), show an error message and do not allow the user to access the web application".
This happened with both Firefox 59.0.2 (32-bit) and Chrome (65.0.3325.146 (64-bit)).
My question: Why would a browser allow a user to click through certificate errors on a website where HSTS is enabled?