Skip to main content
A
Anonymous
June 2, 2016
Question

Weighing Options after Undoing HSTS Policy to Exclude SubDomains

  • June 2, 2016
  • 2 replies
  • 2272 views

Prior to implementing Marketo, we accidentally set up an HSTS policy to include SubDomains but have since removed that option. However, existing leads/customers who may have visited our main site would now have cached and would therefore see a SSL error when they visit any of their subdomains. Unless they revisit our main site again to reload the new policy without the includeSubDomain, they would see that SSL error. One method we thought of is using a separate domain name for an initial subdomain then going back to our Marketo subdomains once we're more certain that the old policy has been replaced with the new one on users' browsers caches.

However, we know that would have significant tracking implications because of the cookies not carrying over. Does anyone have any other recommendations that don't involve the time and $ of working with Marketo Pro Services (I can't wait 2-3 weeks or spend a ton beyond the budget I had for MA)? We are stuck here!

@Jimmy@rubiconmd.com

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

2 replies

SanfordWhiteman
SanfordWhiteman
Level 10
June 2, 2016

We accidentally set up a HSTS policy to include SubDomains but have since removed that option. However, existing users who may have visited our main site would now have that cached and would therefore see a ssl error when they visit any of our subdomains. Unless they revisit our main site again to reload the new policy without the includeSubDomains, they would see that ssl error. (not sure if we need this last part after just reading your post on the other channel? => ) One method we thought about to get around this problem is to use a separate domain name for an initial campaign. Then go back to using our subdomains once we're more certain that the old policy has been replaced with the new one on users' browser caches.

However, we know that would have significant tracking implications because of the cookies not carrying over. Does anyone have any other recommendations that don't involve the time and $ of working with Marketo Pro Services (I can't wait 2-3 weeks or spend a ton beyond the budget I had for MA)? We are stuck here!

One thing you didn't quite reveal is why you want to revert the includeSubDomains. Is it because of the expense of setting up with Marketo?  B/c if that's the only reason, and you already have a wildcard or SAN cert that covers your Marketo subdomain, you can steer your traffic through an inexpensive CDN like CloudFront, where there is no setup or maintenance fee (other than renewing your cert, which you're presumably already doing).

A
Anonymous
June 2, 2016

Hi Sanford, thanks for your reply. Unfortunately, HSTS policy doesn't allow us to cherry pick which subdomains we wish to secure.  It's a binary event. Since we don't wish to secure every subdomain nor would we have the ability to do so due to some of the third party services we're redirecting to, it's better for us to remove that specific policy of including all subdomains.

I'm unsure what exactly would you accomplish by using a CDN? Would you please explain your thought process there? Thanks.

SanfordWhiteman
SanfordWhiteman
Level 10
June 2, 2016

Using a CDN (or, more broadly, any reverse proxy) allows you to secure the first hop of end-user connections even if the true origin server only uses plain text. The clients connect to the CDN over SSL.  The CDN connects to the origin server over plain text. The CDN ignores HSTS policies as directed.

Enforcing a domain-wide "SSL Everywhere" policy may require the use of one or more reverse proxies.

SanfordWhiteman
SanfordWhiteman
Level 10
June 3, 2016

Referrers are removed by browsers when the end-user navigates from a secure to an insecure site.  The fact that the the CDN server is communicating with a deeper origin server is totally unknown to the browser.  Every day, your browser connects to systems like this (SSL front end, non-SSL back end) and doesn't know it. The referrer is not affected. The browser only sees SSL.

For click tracking, the referrer is not used, so it wouldn't matter whether it's affected or not (though it's not).

Terms & ConditionsAccessibility statement

Loading footer...