Demo
Demo

Knowledge base

PMTA knowledge base›Block Global›Directive§ 3.3.1.58.6

http-strict-transport-security-max-age

Globalrestart required

How long the browser remembers that the monitor is reached only over encryption
in the configuration this is a linehttp-strict-transport-security-max-age 0inside the block Global
Forbidding the browser to reach the monitor in the clear

The Strict-Transport-Security header tells the browser: reach this node only over encryption, and remember that for so many seconds. The line sets the number itself. The default is 0, that is, the browser remembers nothing.

It only works for a browser. A program that reaches the monitor with its own client usually ignores the header — so for the Hub or other automation the line gives nothing.

It becomes meaningful together with http-redirect-to-https. The redirect by itself protects only the request that has already arrived; the header makes the browser not even try an unencrypted connection next time.

We checked on a fleet node: the monitor does return this header with the value max-age=0 — that is, the line is always present in the response, the only question is the number.

The main trap is setting a large number before encryption works. The browser will remember the prohibition and stop opening the monitor at the plain address — and if encryption breaks later, there will be no access at all, and the browser’s memory will have to be cleared by hand.
What the Hub does. It does not write it — it leaves 0. For our polling the header is useless: the client is not a browser. The line will become meaningful when people start using the monitor — and only together with the redirect to https enabled.
Recommended values

The order is exactly this: first encryption, then remembering it:

Value When
0 (default) encryption is optional, programs connect
86400 trial run: a day of memory, easy to roll back
31536000 a year, when everything has settled

Setting the number without enabling http-redirect-to-https is pointless.

The default 0 and the purpose are from the manual (§ 3.3.1.58.6). That the monitor returns the header with the value 0 is our check on a fleet node. The trial-run order is ours.
Example configuration
# first encryption, then remembering it
http-mgmt-port 1000
http-redirect-to-https true
http-strict-transport-security-max-age 86400
A day for a trial run. A year is set when monitor encryption works steadily and no rollback will be needed.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Setting a year without enabling the redirect to https

our experience

What it costsThe browser remembers the prohibition on plain connections, while encryption is optional. One certificate failure is enough for the monitor to stop opening at all.
How to spot itThe browser refuses to open the monitor and does not offer to continue.
How to do it rightFirst http-redirect-to-https true and a working certificate, then the number — starting with a day.

Expecting the header to protect a program client

our experience

What it costsThe header is enforced by the browser. A program that reaches the monitor with its own client will keep connecting as before.
How to spot itThe line is set, but automation still connects in the clear.
How to do it rightChange the scheme in the client itself; the header has nothing to do with it.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
http-strict-transport-security-max-age <integer>
Values
an integer number of seconds; 0 — do not remember
Default
0 § 3.3.1.58.6
Applying
a service restart is required
Queue
will not touch what is already queued
Where to write it
Global
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
No inheritance: the line is written at the root of the file, the Global section, and applies to all monitor responses.
⇄

Related directives

1 relation

Applies to

http-mgmt-portGlobalOne of the settings of the very interface that listens on this port. § 3.3.1.58.6

How to check on the node
The header is visible in the monitor’s response — we look at it in full:
curl -s -D - -o /dev/null http://NODE:1000/status | grep -i strict-transport
Strict-Transport-Security: max-age=0 — the default, the browser will remember nothing. Any other number means the line is set and has taken effect.
◇

What else to read

3 articles

◇Who is allowed to submit mail and for whom to accept itOut of the box, the node accepts submission only from the machine itself; two different questions — “who can send through us” and “for whose addresses we accept mail” — are answered by different directives.◇The group that grants management rightsMembership in the pmta group gives an unprivileged user the right to call the node’s commands and use submission.◇How the node selects a source and combines its settingsA connection falls under all source blocks whose addresses cover it, and they act merged — the narrow one overrides the wide one; named blocks are attached only by direct reference.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Node security
Neighboring settings of the block Global:run-as-roothttp-accesshttp-api-keyhttp-csrf-protectionhttp-redirect-to-httpsAll 108 directives of the block →