一次 HSTS 策略配置的排错之旅

这几天才发现，mail.mmf.moe 的服务不知道为什么上不去了。出错的地址是 https://mail.mmf.moe，这令我大惑不解。

尝试了一下 curl，发现 http 没有问题，https 就是不行。

http 结果：

$ curl -v http://mail.mmf.moe                           
*   Trying 172.217.24.19:80...
* Connected to mail.mmf.moe (172.217.24.19) port 80 (#0)
> GET / HTTP/1.1
> Host: mail.mmf.moe
> User-Agent: curl/7.72.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Location: https://mail.google.com/a/mmf.moe
< Date: Fri, 04 Sep 2020 09:51:17 GMT
< Content-Type: text/html; charset=UTF-8
< Server: ghs
< Content-Length: 230
< X-XSS-Protection: 0
< X-Frame-Options: SAMEORIGIN
< 
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="https://mail.google.com/a/mmf.moe">here</A>.
</BODY></HTML>
* Connection #0 to host mail.mmf.moe left intact

https 的结果：

$ curl -v https://mail.mmf.moe
*   Trying 172.217.24.19:443...
* Connected to mail.mmf.moe (172.217.24.19) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mail.mmf.moe:443 
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mail.mmf.moe:443

既然如此，那不如直接用 http？何必跳转到 https 呢？我尝试了一下，但是无论如何他都会自动跳转到 https。通过 Developer Tools，我发现跳转的状态码是 307：