1

I enabled HSTS in the Tomcat web.xml like this:

<filter>
    <filter-name>httpHeaderSecurity</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    <async-supported>true</async-supported>
    <init-param>
        <param-name>hstsMaxAgeSeconds</param-name>
        <param-value>31536000</param-value>
    </init-param>
    <init-param>
        <param-name>hstsIncludeSubDomains</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

For one test website like myqa.example.com, it shows the correct HSTS header:

Strict-Transport-Security: max-age=31536000;includeSubDomains

However, for another outbound website, like realone.example.com, it shows the HSTS header without includeSubDomains:

Strict-Transport-Security: max-age=31536000;

realone.example.com has an EV certificate which has only one valid DNS name realone.example.com. In the meantime myqa.example.com have a SAN certificate.

Any idea why realone.example.com doesn't include "includeSubDomains"?

0

You must log in to answer this question.

Browse other questions tagged .