Hacker News Reader

It also have funny interactions with expired certs, I remember some obscure OSS app page being inacessible via browser because:

* author forgot to renew the cert like, day before

* author also set up HSTS and both browsers said "nope, we won't even let you add exception for this one".

View on HN

Not so much "funny" as necessary.

The alternative is that if I can mess up their HTTPS connections to your site with HSTS, users just click the "exception" button and it undoes all the benefits of HSTS.

That's kind of the point of HSTS. Your browser remembered that there was previously a valid certificate, and when the certificate expired your browser honored the HSTS header. If you clear your browser cache you should be able to access the site again.

Reply on news.ycombinator.com