I'd like to submit my personal site into the Chrome HSTS preload list.
The site there says:
In order to be included on the HSTS preload list, your site must:
- Have a valid certificate.
- Redirect all HTTP traffic to HTTPS - i.e. be HTTPS only.
- Serve all subdomains over HTTPS.
- Serve an HSTS header on base domain:
- Expiry must be at least eighteen weeks (10886400 seconds). The includeSubdomains token must be specified. The preload token must be specified. If you are serving a redirect, that redirect must have the HSTS header, not the page it redirects to.
Does this mean my certificate must be valid for all subdomains, or only that they are available/served over HTTPS? (I have a certificate for
sub.example.com, but not the root.)
Can I apply to the HSTS preload list with a subdomain, like