Nginx HSTS Missing From HTTPS Server (RFC 6797)

Products

• Carbon Black EDR

Issue/Introduction

Vulnerability scanner found HSTS Missing From HTTPS Server (RFC 6797)

Environment

• Carbon Black EDR Server: All Supported Versions

Cause

Configuration is missing from cb.server.custom, or another application is responding without HSTS.

Resolution

1. Access the Server: Log in to your Carbon Black EDR server via SSH with root or sudo privileges.
2. Verification: Confirm HSTS is being used with OpenSSL: 
   1. Run openssl with the quiet switch 

      openssl s_client -connect servername:443 -quiet

   2. It will provide a little info then holds. Next, type the following 

      GET / HTTP/1.1
      Host: servername

   3. Hit enter twice, it will print out details including the Strict-Transport-Security max-age to validate if HSTS is being used.
3. If Strict-Transport-Security is not seen:
4. Modify Configuration: Open the file /etc/cb/nginx/conf.d/includes/cb.server.custom and add the following line: 

   add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

5. Apply Changes: Restart the Nginx service. 

   /usr/share/cb/cbservice cb-nginx restart

6. Verification: Verify again using step 2. 

Additional Information

• HSTS is enabled by default. 
• Once enabled, browsers will strictly require a valid HTTPS connection. Ensure your SSL certificates are healthy before applying this change. This setting only affects browser-based access (Web UI) and does not impact EDR sensor-to-server communication.