Need help with HSTS issue domain wide

[Daniel9483]

Having an issue with accessing internal sites and redirects now with HSTS warnings on Edge. Chrome & Firefox.

Tried accessing the HSTS settings in both edge & chrome and deleting them, as well as pushed GPO to force secure dns is turned off. both tried rebooting, system, and clearing cache and restarting browsers, but still no luck, anyone have any ideas? we don’t have IIS set on our PDC, but running the query from chrome or edge, shows that are root domain is forcing hsts, but can’t figure out how to disable it.

Tried all of the articles out there, no luck. anyone have any other ideas to help, please?

[Rod-IT]

What changed to enforce this and over 3 different browsers?

Are all internal sites secure are they all on the same box - perhaps it’s server side, not client.

[phildrew]

The web (IIS?) server has to set HSTS to enabled - it cannot happen from the client.

Since the server (or WAF) has it set, clearing from the client will do nothing - the next time you go back to the site it will get the (bad) HSTS header again and the problem recurs.

HSTS should not be enabled without a full contingency plan in place (else your page becomes inaccessible), and full understanding of the implications.

[phildrew]

The most likely explanation is that HSTS was turned on for your public website. And when doing so, subdomains was selected.

You also have your internal domain name the same as public.

So, when you go to www.MyCorp.com it loads the HSTS header, and says that any subdomains/sites (*.MyCorp.com) sites must use the published cert.

When you go to an internal site - something.MyCorp.com, the browser expects to see that cert, but doesn’t. It then thinks you are subject of a MitM attack where someone is redirecting you to a different website (because the cert doesn’t match).

HSTS sounds like a good idea in practice - but you probably don’t want to do it if you’re not Fortune500 or something.

I’d look at your public website first - this is probably not being caused by the on-prem web hosts.

[blue-brian]

It sounds like your root domain is enforcing HSTS, which causes internal site issues. Since clearing browser caches and GPO tweaks didn’t help, you may need to address headers server-side or in DNS. This guide may help.

https://certera.com/blog/how-to-disable-hsts-in-chrome-firefox/