SSL Enabling HSTS for SSL ?

Thanks

Code:

https://cryptoreport.geotrust.com/checker/views/certCheck.jsp

reports:

Code:

Strict Transport Security (HSTS):UNKNOWN

Is this normal?

And this one:



Also after enabling HSTS i didn't get an A plus

---

 

SSL Server Test (Powered by Qualys SSL Labs)

reports A and not A+

Last issue to solve

 

I am not behind Cloudflare at all .....

ssllab report:

Code:

Strict Transport Security (HSTS)     No

but i already enable it about 20 minutes ago .....

Code:

  # before enabling HSTS line below read centminmod.com/nginx_domain_dns_setup.html#hsts
  add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

and restart a few times Nginx and Phpfpm....

 

?

 

Ok but this one doesn't report anything:

Code:

curl -Is https://mydomain.com | grep Strict

 

The generated ssl conf file has inside two times this line:

Code:

include /usr/local/nginx/conf/staticfiles.conf;

on top:

Code:

 
return 302 https://$server_name$request_uri;
   include /usr/local/nginx/conf/staticfiles.conf;
 }

and at the bottom also:

Code:

include /usr/local/nginx/conf/staticfiles.conf;
include /usr/local/nginx/conf/php.conf;

Is this needed?

I already comment the one at the bottom and replace the one on top with this one:

Code:

include /usr/local/nginx/conf/staticfiles-hsts.conf;

 

Yes !

 

staticfiles-hsts.conf :

# prepare for letsencrypt # https://community.centminmod.com/posts/177 - Pastebin.com

mydomain.com.ssl.conf :

#x# HTTPS-DEFAULT server { server_name mydomain.com www.mydomain.com; - Pastebin.com

Can't found anything

 

Don't know then why it doesn't work

Anyway not big deal ....