HTTP严格传输安全性不适用于IP地址

Question

我使用nginx为IP地址设置了证书,并启用了http严格的传输安全性:

add_header  Strict-Transport-Security "max-age=31536000; includeSubdomains;";

该指令位于标题中

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 17 Sep 2014 22:46:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-UA-Compatible: IE=Edge,chrome=1

...但它不受浏览器的尊重(相反,它们适用于FQDN).

Answer 1

如果我理解正确,您可以将浏览器指向IP地址(https://xx.xx.xx.xx/)而不是域名并期望它遵守HSTS规则吗？

但RFC 6797附录A明确排除了IP地址:

HSTS主机仅通过域名识别- 排除所有表单的显式IP地址识别.