1

I enabled HSTS in the Tomcat web.xml like this:

<filter>
    <filter-name>httpHeaderSecurity</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    <async-supported>true</async-supported>
    <init-param>
        <param-name>hstsMaxAgeSeconds</param-name>
        <param-value>31536000</param-value>
    </init-param>
    <init-param>
        <param-name>hstsIncludeSubDomains</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

For one test website like myqa.example.com, it shows the correct HSTS header:

Strict-Transport-Security: max-age=31536000;includeSubDomains

However, for another outbound website, like realone.example.com, it shows the HSTS header without includeSubDomains:

Strict-Transport-Security: max-age=31536000;

realone.example.com has an EV certificate which has only one valid DNS name realone.example.com. In the meantime myqa.example.com have a SAN certificate.

Any idea why realone.example.com doesn't include "includeSubDomains"?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.