Today another small Blogpost on making your NetScaler Gateway / Access Gateway Enviroment (or any other Website published through a NetScaler) a little more secure by implementing HTTP Strict Transport Security (HSTS or STS). This should take you no longer than 15 Minutes to implement.
Let's get started. First we have to create a Rewrite Action and a Rewrite Policy. We start with the Rewrite Action:
Configure the Rewrite Action with the following Parameters as shown in the Screenshot.
- Name: Insert_STS_Header (feel free to name it whatever you want to)
- Type: INSERT_HTTP_HEADER
- Header Name: Strict-Transport-Security
- String: "max-age=157680000"
The max-age Value is given in seconds.
For all the CLI Fans here are the needed Snippets:
The next Step is to create the Rewrite Policy.
Create the Rewrite Policy with the following Parameters (see the following Screenshot)
- Name: Enforce_STS
- Action: select the previously created Rewrite Action
- Expression: TRUE
Last Configuration Step is to bind it to your Netscaler Gateway / Access Gateway vServer under Policies -> Rewrite (Response) and make sure to save your running Config.
To make sure you configure everything correct you can use the SSL Scanner from Qualys Labs. You should see something similar to this:
Feel free to read my previous Blogpost on how to disable TLS/SSL Client Renegotiations on NetScaler for more SSL/TLS Security.