Resolved ip6 doesn't have HSTS, but ip4 has

[Heinrich]

Hi everyone,
happy new year,


so, I had to move to a new server with ubunut 18.04 and obsidian and when I have my ssllabs check, ip6 doesn't have hsts, despite the switch being activated in PLESK (SSL/TLS settings).

How can I fix this?

Also, is there an option to add "preload" to hsts directly in SSL/TLS settings ?

 

[Brujo]

Well this should work out of the box for ip4 & ip6 or at least it does on my Servers
There are several ways to do it, so you can try for example:

• Extension SSL-It -> there is an option to enable HSTS - How to enable HTTP Strict-Transport-Security (HSTS) for a domain on the Plesk server?
• manually in the Additional nginx directives, there are a lot of examples arround, something like: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

 

[Heinrich]

Yes, I want to use the first approach and have set it up, but it doesn't work.

 

[Brujo]

just to narrow down the issue, please try to add the directive manually and check again

 

[WebHostingAce]

In addition to @Brujo reply. Please check your domain is point to correct IPv6 address.

 

[Heinrich]

I rechecked and AusWeb's tip panned out. The migration wizard hadn't enabled the ipv6 support for the webpages, so the server returned a plesk login screen not protected by HSTS on the ipv6 address. I have since activated the ipv6 for the domain and subdomains in question and now the server works like expected....