HSTS doesn't work on browser when dealing with a self-signed certificate

Question

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to check whether it really works.

I understand that for HSTS to work, there shouldn't be any certificate issues & first we need to access https://somesite.com then in the next pass http request will be automatically redirected to https at client side itself.

So, I installed our self-signed certificate in the Chrome browser & restarted the browser. Now my connection to our web application was secure. But HSTS doesn't seem to work. In the successive calls to http://somesite.com, still we redirect (302) to https (automatic client-side redirection to https doesn't happen). One thing to note here is, there is no domain name associated with our web application, we access it with our server's ip within our company's internal network.

Any idea how to get HSTS working? or is it like HSTS works only if there is a domain name for the site?

Answer 1

Actually, this is already answered in stackoverflow : RFC 6797 Appendix A : HSTS doesn't work for IP address.

You need to setup local DNS server to deal with it.

Answer 2

Watch out with public TLD's in combination with locally-hosted sites and self-signed certs.

For example mysite.dev with a self-signed certificate was causing a HSTS error in all my browsers (Chrome, Edge and Firefox). When I switched to a non-public TLD, for example mysite.localdev it worked like a charm.