: CloudFlare and Avast strict transport This weekend, we started using CloudFlare*. One of our users is reporting that Avast, the anti-virus software, has blocked our site due to a certificate

@Murray432

Posted in: #Cloudflare #Hsts #Https #SecurityCertificate #Virus

This weekend, we started using CloudFlare*.

One of our users is reporting that Avast, the anti-virus software, has blocked our site due to a certificate error.

Presumably this is because our certificate has changed -- we are now using the certificate CloudFlare provides, rather than our own. However, we do not have HTTP Strict Transport Security enabled. Does Avast, as a "feature", enforce an HSTS-like policy even when none is called for?

(* The situation is slightly more complicated: we started using our own CloudFlare account, having previously used the initial site developer's CF account -- obviously this required a change to DNS, CF certificates, and site external IP address(es).)

Vote Up Vote Down

Login to post a comment!