Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.
Sign up to join this community
I am about to buy .dev domain. However registrars warn that it is a "secure domain space" and that I will need SSL certificate for the domain. I am more than happy to make sure the web runs over SSL, but I might to also want to connect over unsecure protocols, such as when using my VPS to play games with friends.
What does "Secure domain space" mean technically?
Secure Domain Space TLD's are encrypted at the domain level using HSTS.
Theoretically you would still be able to connect to it for gaming, but hosted websites will be encrypted by default.
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks1 and cookie hijacking. Source Wikipedia
.dev top level domain, Google got the entire TLD added to the HSTS preload list. Browsers that support HSTS (Chrome and Firefox) will never allow a insecure HTTP connection to a .dev site. Clients that don't support HSTS (such as most games) won't be affected.
Dec 20, 2019 at 13:58
What does "Secure domain space" mean technically?
Nothing specially, as this is not a technical specification.
Here is what happens.
1) HSTS is a new standard, implemented by many browsers, that prohibits them to connect over HTTP and force HTTPS. This either happens after the first connection through HTTP (the server replies with some headers dictating the browser to restart the connection over HTTPS and keep doing that for a given amount of time - of course this is vulnerable to the first connection being hijacked) OR because the website is registered into an "HSTS preloading list", which is then included in browsers code source (in that case, there is no vulnerability, as even the first connection will be over HTTPS, never over HTTP)
2) Google Registry decided to add all its newer TLDs (DEV, NEW, APP) in the HSTS preloading list. It means no standard browser will ever do an HTTP query to any hostname in those TLDs
3) Contractually, Google Registry forces registrars to display a message during registration, to warn them about the above. Of course, it would have been too simple to just explain the above, and instead they just put some vague marketing terms, and even such nonsense as "SSL certificate". Each registrar can either use the text given by the registry, or any other one, but the registry mandates the registrar to show screenshots of its checkout before Google Registry accepts it as good enough and authorizes domain registrations through this registrar.
So in short, all that means is that due to Google adding its TLDs in the preloading list, if you have a website there and want normal browsers to access it, you need to enable HTTPS (and hence have a certificate), because it will never work over HTTP.
All the above has no consequences at all for any other protocols (which shows that "secure domain space" is a claim without merit, for anyone smart enough to remember that a domain is not necessarily used for the web or not only for that; it is an unfortunate frequent wrong shortcut to think that Internet and World Wide Web are the same thing), or any HTTP client not implementing HSTS.
