How do i turn of HSTS

Kobe · March 19, 2025, 1:46pm

Hello,

I have a question regarding provisioning. I am working on provisioning Ubuntu on a Dell server using Foreman, but I ran into an issue while testing the link to fetch the vmlinuz file. I keep receiving the following error:

root@foreman:~# wget http://foreman.example.be/pub/installation_media/ubuntu-22.04/casper/vmlinuz
URL transformed to HTTPS due to an HSTS policy
–2025-03-19 14:42:40-- https://foreman.example.be/pub/installation_media/ubuntu-22.04/casper/vmlinuz
Resolving foreman.example.be (foreman.example.be)… 10.10.100.1
Connecting to foreman.example.be (foreman.example.be)|10.10.100.1|:443… connected.
ERROR: The certificate of ‘foreman.example.be’ is not trusted.
ERROR: The certificate of ‘foreman.example.be’ doesn’t have a known issuer.

I would like to bypass HSTS and not use port 443/HTTPS. How can I configure this so that it uses HTTP instead?

evgeni · March 20, 2025, 6:25am

There is a setting you can turn off:

github.com/theforeman/foreman

config/settings.yaml.example

2a81d51f7


      
          # Mark translated strings with X characters (for developers)
          :mark_translated: false
          
          # Assets in development are not bundled/minified
          # Do not set this to false if you plan to edit assets (css, js, etc.)
          :assets_debug: false
          
          # If you wish to allow browsers access to http resources after accessing the
          # server, you will need to disable HSTS headers. This has security implications
          # so only change this if you know what you're doing.
          :hsts_enabled: true
          
          # Local administrative settings for application domain, fqdn, foreman URL,
          # administrator email address etc. If you don't have a Puppet provisioning
          # system you may want to change to setup your project on your local machine.
          :domain: 'localdomain.net'
          :fqdn: 'localhost.localdomain.net'
          
          # Configure hostnames for ActionDispatch::HostAuthorization
          # Only hostnames are supported. Regular expressions and IP addresses/ranges are not.
          # https://guides.rubyonrails.org/v6.1/configuring.html#configuring-middleware

But you really shouldn’t have to do that? The to-deployed machine should not have any HSTS cache, and we don’t redirect http-to-https on those URLs.