If there's no HSTS record for the domain,
- if it's HTTP, the attacker succeeds.
- if it's HTTPS with an invalid cert, the browser will display a warning and not honor any redirects.
- if it's HTTPS with a valid cert, we assume there is no attack (cert misissuance is an attack outside the scope of HSTS).
If there's an HSTS record for the domain,
- if it's HTTP, the browser will automatically rewrite to HTTPS.
- if it's HTTPS with an invalid cert, the browser produces a hard fail that the user can't override (and ignores redirects).
- if it's HTTPS with a valid cert, as above, the browser accepts the cert and we assume it's not an attack.
If there's no HSTS record for the domain,
- if it's HTTP, the attacker succeeds.
- if it's HTTPS with an invalid cert, the browser will display a warning and not honor any redirects.
- if it's HTTPS with a valid cert, we assume there is no attack (cert misissuance is an attack outside the scope of HSTS).
If there's an HSTS record for the domain,
- if it's HTTP, the browser will automatically rewrite to HTTPS.
- if it's HTTPS with an invalid cert, the browser produces a hard fail that the user can't override (and ignores redirects).
- if it's HTTPS with a valid cert, as above, the browser accepts the cert and we assume it's not an attack.