I have a webapp on Tomcat. I have a self-signed cert for testing SSL. Every call that I make, (get, ajax, css and javascript imports) Firefox is throwing:
Strict-Transport-Security: The connection to the site is untrustworthy, so the specified header was ignored.
Now I have added the exception to FF for my site, and I have a green lock symbol in the upper left of my browser. I know what HSTS is, but I'm pretty sure that I have not set that in any way. In the console, I see this in the response headers:
Strict-Transport-Security:"max-age=31536000 ; includeSubDomains"
So why is FF saying my site it untrustworthy, how did that header get in my response, and how do I make this error go away?
UPDATE I have installed my self-signed cert into my jdk cacerts file. I can connect to the site with HttpsURLConnection, and the request.isSecure() returns true, and request.getScheme() returns https, BUT request.getProtocol() returns HTTP/1.1