I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end client has the domain in the preload list which causes this auth request to go over https rather than http. This causes the authentication to fail and thus the original webpage does not load.

I can fix this by deleting the domain from the HSTS list on a single machine but is there a way to delete this domain from all clients that are part of that domain through GPO. If yes then how can we achieve this.

  • Do you control the HTTPS endpoint, or just the proxy? If the former, you can serve Strict-Transport-Security: max-age=0 to purge it from the HSTS list of any browser visiting the site (coupled with, one imagines, a 301 redirect to the HTTP version of the site). But this only works when served over HTTPS, so if you only control the proxy, it won't work without HTTPS interception (which is a whole 'nother can of worms). – Kevin Nov 21 '18 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.