How do I add HSTS?

Short answer

The recommended way is to turn on the HSTS (Strict-Transport-Security header) switch in a TLS Security Profile, configure the HSTS Duration (max-age), Include Subdomains and optional Browser Preload List Flag settings, and select the profile in the SSL Security module of the HTTP vService; the header is added only to HTTPS responses. Alternatively, the Manage HTTP Security Headers action adds a fixed HSTS value (max-age=16000000; includeSubDomains; preload;), and the Set HTTP Header action adds the desired value; if the vService also has an action, the action's value takes effect. HSTS works only on the HTTP vService.

Background

HSTS (HTTP Strict Transport Security, RFC 6797) is the Strict-Transport-Security header that the server adds to the HTTPS response. A browser that receives the header connects to that domain name only over HTTPS for the max-age duration; http:// connections are converted to HTTPS before the request is sent, and a certificate error cannot be bypassed by the user. includeSubDomains extends the rule to the subdomains; preload is the flag required for applying to include the domain name in the HSTS list built into browsers (hstspreload.org).

Problem: Browsers Still Try HTTP on the First Request

Even if there is an HTTP → HTTPS redirect, the browser may first send an unencrypted request on each new visit; this first request is open to man-in-the-middle attacks. The HSTS header tells the browser to connect to the site only over HTTPS for a certain period. A valid HSTS header is also required for an SSL Labs A+ grade (What should I do to get an A+ from SSL Labs?).

Solution: Four Methods

The methods are alternatives to each other; HSTS is managed from a single place.

Your situation	Suitable method
Through a profile, setting the duration and the directives	Method 1: TLS Security Profile
A ready-made fixed value together with the other security headers	Method 2: Manage HTTP Security Headers
A fully custom value, or only under certain conditions	Method 3: Set HTTP Header
From the command line	Method 4: WEB-CLI

Method 1: TLS Security Profile Recommended

• How it works The profile adds the Strict-Transport-Security: max-age=<seconds>[; includeSubDomains][; preload] header to the responses in the TLS connections of the HTTP vService.
• Where it is openedCertificates & PKI → TLS Security Profiles → Frontend-only Settings → HSTS (Strict-Transport-Security header)
• Requirement Encrypted (HTTPS) frontend and a certificate on the HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → TLS Security Profiles screen, Add is clicked (how to add); if a custom profile is already used in the vService, that profile is selected and Edit is clicked. In a new profile, Security Profile Name is entered.

2

Adım 2 Turn on HSTS

In the Frontend-only Settings section, the HSTS (Strict-Transport-Security header) switch is turned on (off by default).

3

Adım 3 Select the duration and the directives

HSTS Duration (max-age) is 180 days by default; it is entered as a number and a unit (hours, days, weeks, months, years), and it is at least 1 hour. If the subdomains are also to be covered, Include Subdomains (includeSubDomains) is turned on. If a preload application is to be made, Browser Preload List Flag (preload) is turned on; this flag is saved only while the duration is at least 1 year and Include Subdomains is on, otherwise the form gives the preload requires a max-age of at least 1 year and includeSubDomains error. Because a month is counted as 30 days in the duration calculation, 12 months is not enough; 1 years or 365 days is selected.

4

Adım 4 Save the profile

Add at the bottom of the form is clicked (Edit in an existing profile).

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Select the profile

In the Details panel, the SSL Security box under Frontend Settings is checked and the profile is selected (profile selection on the vService).

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1HSTS headerClient side

The headers of the HTTPS response are read; the header is not present in the HTTP response.

Command: curl -skI https://www.example.com/ | grep -i strict-transport-security

ExpectedStrict-Transport-Security: max-age=31536000; includeSubDomains

The value is given for 1 year and Include Subdomains; a single header must appear.

Method 2: Manage HTTP Security Headers

• How it works The Strict-Transport-Security (HSTS) option in the Response Headers list of the action writes the fixed max-age=16000000; includeSubDomains; preload; value to the responses in TLS connections (about 185 days). The action runs unconditionally; headers such as X-Frame-Options and X-Content-Type-Options can also be added from the same list.
• Where it is openedLoad Balancer → Actions → Action Type = Manage HTTP Security Headers
• Requirement Encrypted (HTTPS) frontend on the HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

2

Adım 2 Select the header

Action Name is entered; Action Type = Manage HTTP Security Headers is selected. In the Response Headers list, Strict-Transport-Security (HSTS) is checked. The form has no condition or execution timing field; the action runs on every response.

3

Adım 3 Save the action

Add is clicked; the action is added to the list.

4

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

5

Adım 5 Add the action to the vService

In the Details panel, the Actions box under Modules is checked and the action is selected in the field that opens.

6

Adım 6 Save

Save is clicked. The action does not run unless it is added to the vService.

Verification

1HSTS headerClient side

Command: curl -skI https://www.example.com/ | grep -i strict-transport-security

ExpectedStrict-Transport-Security: max-age=16000000; includeSubDomains; preload;

Method 3: Set HTTP Header

• How it works The Strict-Transport-Security header in the response is written with the desired value as a single header; it replaces the HSTS header sent by the server itself. With a condition, it is applied only to HTTPS responses or to specific paths.
• Where it is openedLoad Balancer → Actions → Action Type = Set HTTP Header
• Requirement Encrypted (HTTPS) frontend on the HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

2

Adım 2 Define the header

Action Name is entered; Action Type = Set HTTP Header and Execution Level = On Response are selected. Header to Edit = Strict-Transport-Security and Header Content = max-age=31536000; includeSubDomains are written.

3

Adım 3 Select the condition

In the Conditions field, the ready-made If SSL is terminated condition is selected; this way, the header is added only to HTTPS responses.

4

Adım 4 Save the action

Add is clicked; the action is added to the list.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Add the action to the vService

In the Details panel, the Actions box under Modules is checked and the action is selected in the field that opens.

7

Adım 7 Save

Save is clicked.

Verification

1HSTS headerClient side

The HTTPS and HTTP responses are read separately.

Command: curl -skI https://www.example.com/ | grep -i strict-transport-security

ExpectedA single header on HTTPS · no header on HTTP

Method 4: WEB-CLI

• How it works The HSTS fields of the profile and the vService assignment are configured from the command line.
• Where it is opened TR7 WEB-CLI → lb ssl-security update · lb service update
• Requirement WEB-CLI access; Encrypted (HTTPS) frontend on the HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Turn on HSTS in the profile

In place of <profile>, the profile name is selected with Tab (HSTS fields):

lb ssl-security update id <profile> --hsts true --hstsMaxAge.val 1 --hstsMaxAge.unit y --hstsIncludeSubdomains true

2

Adım 2 Assign the profile to the vService

--sslSecurity replaces the vService's profile with this profile:

lb service update id <vService> --sslSecurity <profile>

Verification

1HSTS headerClient side

Command: curl -skI https://www.example.com/ | grep -i strict-transport-security

ExpectedStrict-Transport-Security: max-age=31536000; includeSubDomains

Common Mistakes

• Adding HSTS with both a profile and an action. If the vService has an action that adds HSTS, the value of the action replaces the value of the profile; HSTS is managed from a single place.
• Adding HSTS with the Add HTTP Header action. This action adds the header next to the existing one; if the server also sends HSTS, two headers appear in the response. For a custom value, Set HTTP Header is used.
• Applying for preload with the fixed value in Manage HTTP Security Headers. The fixed duration (16,000,000 seconds, about 185 days) is below the 1 year required for preload; for preload, Method 1 is used.
• Expecting HSTS on an L7 TCP vService. HSTS is an HTTP header; it is added only on an HTTP vService.
• Using HSTS in place of the redirect. For the first visit, an HTTP → HTTPS redirect on port 80 is still required (How do I redirect HTTP to HTTPS?).
• Turning on preload to try it out. A domain name that enters the preload list cannot be removed easily; it is not turned on before it is verified that all the subdomains are ready for HTTPS.

How it is done in the documentation

• TLS Security Profiles · HSTS (Strict-Transport-Security header)
• TLS Security Profiles · Browser Preload List Flag (preload)
• Manage HTTP Security Headers · Response Headers
• Set HTTP Header · Header to Edit

Related questions

• How do I redirect HTTP to HTTPS?
• What should I do to get an A+ from SSL Labs?
• What is a TLS Security Profile, and what does it configure?