[danielweber]

It looks like it's still in the development phase? I'd like to start recommending it to clients, and then testing it on client sites, but right now I can't.

EDIT: Oh, apparently plug ins for nginx and apache are now available. Sweeeeet.

EDIT: Although I'm a bit nervous about turning it on. Several weeks ago I couldn't get to one of my websites where I had turned on HSTS for about an hour from Chrome, and I got absolutely no feedback from Chrome about what the problem was.

[newman314]

Was HSTS the problem? Or did it end up being something else?

[danielweber]

I still don't know, which is why it is such a nagging problem in my gut.

Chrome acted like it was HSTS, because it refused to let me connect at all, not even with a "it's okay to connect for now." And it went away by itself after about 30-60 minutes.

I'm sure I could have wiped out some Chrome settings to fix this, but this site is also used by our customers, and I really really wanted to understand what it was. Fortunately I was the only person who has ever ran into it so far.

Is there an HSTS user group I could ask about this?

[newman314]

You could always ask agl, he might have some suggestions.

What I've seen in the past is that Chrome occasionally gets over aggressive in caching (in an attempt to be "fast" I guess). Clearing all the caches out, flushing DNS etc. usually fixes it for me.