How to disable HSTS - HTTP Strict Transport Security

SUSE Multi Linux Manager 5.x

HSTS is enabled while using the default SSL certificate generated by SUSE Manager or a self-signed certificate, browsers will refuse to connect with HTTPS unless the CA used to sign such certificates is trusted by the browser.

Create a custom file:

vim /etc/apache2/conf.d/zz-spacewalk-www-custom.conf

Add below line to the file:

Header always set Strict-Transport-Security "max-age=0; includeSubDomains"

Restart apache2 service:

systemctl restart apache2

Verify on the client or Web by accessing the SMLM URL to know if the HSTS is disabled:

curl -v https://<SMLM FQDN >

If Enabled:

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/1.1 200 200
< Date: Fri, 18 Jul 2025 12:55:25 GMT
< Server: Apache
< X-Frame-Options: SAMEORIGIN
< Strict-Transport-Security: max-age=63072000; includeSubDomains

If Disabled:

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/1.1 200 200
< Date: Fri, 18 Jul 2025 12:54:46 GMT
< Server: Apache
< X-Frame-Options: SAMEORIGIN
< Content-Type: text/html;charset=UTF-8
< Vary: Accept-Encoding

The CA used to sign the self signed certificates is not trusted by the browser .Hence refusing connecting to the Server.