2

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to check whether it really works.

I understand that for HSTS to work, there shouldn't be any certificate issues & first we need to access https://somesite.com then in the next pass http request will be automatically redirected to https at client side itself.

So, I installed our self-signed certificate in the Chrome browser & restarted the browser. Now my connection to our web application was secure. But HSTS doesn't seem to work. In the successive calls to http://somesite.com, still we redirect (302) to https (automatic client-side redirection to https doesn't happen). One thing to note here is, there is no domain name associated with our web application, we access it with our server's ip within our company's internal network.

Any idea how to get HSTS working? or is it like HSTS works only if there is a domain name for the site?

2
  • Can you provide more info about "automatic client-side redirection to https doesn't happen" what error are you seeing? Aug 9, 2018 at 16:16
  • I am not seeing any errors, it's just that the redirection doesn't happen. Aug 9, 2018 at 16:25

2 Answers 2

5

Actually, this is already answered in stackoverflow : RFC 6797 Appendix A : HSTS doesn't work for IP address.

You need to setup local DNS server to deal with it.

2
  • Bittersweet defeat.. I was afraid of this. This isn't ideal for a travelling dev laptop. Works fine on office WIFI with DNSMASQ but not anywheree else. Looks like local DNSMASQ. I foresee quite a few frustrations about this..
    – BoeroBoy
    Feb 12, 2019 at 12:45
  • 5
    Correction, I found the whitelist easter egg workaround on another thread: You can type 'thisisunsafe" anywhere on the Google Chrome warning page and it will load it without warning. No joke.
    – BoeroBoy
    Feb 12, 2019 at 13:21
1

Watch out with public TLD's in combination with locally-hosted sites and self-signed certs.

For example mysite.dev with a self-signed certificate was causing a HSTS error in all my browsers (Chrome, Edge and Firefox). When I switched to a non-public TLD, for example mysite.localdev it worked like a charm.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .