Is it possible to internally use HSTS preloading for internal domains?

Question

Many companies have internal applications, and it would not be wise to recommend these are opened to the public internet merely for the purpose of them making it onto the HSTS preload list. Even if these services were audited and user credentials are all strong, exposing infrastructure majorly increases the attack surface.

Is there a way to add custom (internal) domains to the preload list in major browsers? For example, rolling this out via the Active Directory to all users?

Answer 1

I don't have a good answer, but for future visitors, workarounds can include:

• Setting up a public web server that obtains a valid certificate for the internal domain being used and allows the domain to be added to the preload list. Internal applications should all use subdomains of this domain.
• Rolling out bookmarks that use https:// for the internal applications. This is only about the first request anyway: after that, the browser will have seen the HSTS header from the service itself. This will, however, not redirect any <a href=http://...> links upon first visit. I also don't know how often people type an actual domain, especially upon initial discovery, versus clicking a link. This needs to be maintained actively.
• Rolling out a policy that blocks http:// URLs for each internal application. This has the downside that users see an error page rather than being permanently redirected. The list also needs to be maintained actively.