3.6 Configuring HSTS Max-Age

You can adjust the HTTP Strict Transport Security (HSTS) max-age parameter in Change Guardian to ensure HTTPS connections remain enforced for at least one year.

To Configure the HSTS Header Settings:

  1. Login to the Change Guardian server’s SSH console.

  2. Navigate to the Jetty configuration directory.

    /etc/opt/novell/sentinel/3rdparty/jetty/

  3. Create a backup of the jetty.xml file.

  4. Open jetty.xml in a text editor.

  5. Find each instance of the Strict-Transport-Security header configuration and update the max-age value from 5 to 31536000.

    Example 3-1 The configuration

    <Item>
    <New id="header" class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
    <Set name="pattern">*.html</Set>
    <Set name="name">Strict-Transport-Security</Set>
    <Set name="value">max-age=31536000</Set>
    </New>
    </Item>

  6. Save your changes.

  7. Restart the Change Guardian services to apply the configuration.

    /opt/netiq/cg/scripts/cg_services.sh restart.