Forum Discussion
negin
Altostratus
AltostratusHSTS
Hello Dear when enable HSTS in profile insert HSTS in header but when test with ssl lab and another tools for test hsts show there is not hsts.How can I fix this problem? my firmware f5 is 12.1.2 ...
neginAltostratus
Altostratusthis IRULE HSTS:
when RULE_INIT {
set static::expires [clock scan 20200926]
}
when HTTP_RESPONSE {
HTTP::header insert Strict-Transport-Security "max-age=[expr {$static::expires - [clock seconds]}]; includeSubDomains"
}
I recommend you to check this video ->
https://www.youtube.com/watch?v=XoYp5e4kRW4
To test it, you need to check it using curl (see video) or using advanced browsing
>>Right Click Chrome Browser>>Inspect>>Network
>>Righ Click Mozilla Browser>>Inspect Element>>Network
KR,
Dario.
- negin
Hello Dear
when I Checked with curl and inspect Element firefox show hsts but when use ssl lab and burp suite for check does not display hsts.
For me, everything seems to be working perfectly from F5 perspective.
If you are receiving an MITM ERROR MESSAGE when you use Burp is totally normal, because Burp is The Man In The Middle and maybe it is trying to downgrade you communication to HTTP.
The problem is your scenario, not the HSTS solution.
