pfSense

Hint: Use haproxy with SNI and forget the ports. See https://github.com/PiBa-NL/pfsense-haproxy-package-doc/wiki (and yes, you can use it for pfSense webGUI as well, as long as you move the webGUI to a custom port instead of 443.)

A potential workaround may be to use a different host name for other NAT'ed ports.

Having same issue, all HTTP sites are also broken like the original example. Need option in pfsense to disable HSTS.

Bump here. This breaks even things running on pfSense itself, such as the darkstat package (HTTP only). It will break other packages as well when you need to switch the GUI protocol (e.g. Lightsquid), because, well: "max-age=31536000".

Most importantly, it makes switching back to HTTP pretty much impossible without stupid browser-specific hacking, at least if you want to still use the same FQDN. And trying by IP will often trigger the DNS rebinding error, and at that point, you are just very much screwed.)

Really no good to have it hardcoded. The haproxy hint above is of course still valid but lots of work for home setups.

Kill Bill wrote:

Most importantly, it makes switching back to HTTP pretty much impossible without stupid browser-specific hacking, at least if you want to still use the same FQDN. And trying by IP will often trigger the DNS rebinding error, and at that point, you are just very much screwed.)

What is so difficult about clearing browser cookies?

NOYB NOYB wrote:

What is so difficult about clearing browser cookies?

Nothing except that it's completely useless. E.g. in Chrome, you go fiddle with chrome://net-internals/#hsts to fix this.

Another thing, if the pfSense GUI is behind a reverse proxy (in my case Nginx) you can't enable HSTS on Nginx as it would result in twice HSTS headers..
So you can't make HSTS global on your reverse proxy, you have to customize the config file only for pfSense.

An option to disable HSTS would be really great.

Got fed up with this... People who are interested in having HSTS optional kindly test this: https://github.com/pfsense/pfsense/pull/3856

Tested on pfSense-netgate-memstick-ADI-2.4.2-DEVELOPMENT-amd64-20171103-1355.img, works as expected.

HSTS box unchecked
user@work-laptop ~ $ curl -I -k -D- https://pfsense.localdomain | grep -i Strict  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=31536000

HSTS box checked
user@work-laptop ~ $ curl -I -k -D- https://pfsense.localdomain | grep -i Strict  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
user@work-laptop ~ $