{{ message }}
Repository navigation
Compliance guide #53
Description
One page that just goes down, piece by piece, what you should do to meet this guidance's standards. In response to an email I got today, asking me for that.
Metadata
Metadata
Assignees
Labels
No labels
Activity
alex commentedon Mar 12, 2015
Items for the checklist (in no particular order):
includeSubDomainsto HSTSgbinal commentedon Mar 18, 2015
👍
pwnall commentedon Mar 18, 2015
I think it'd be helpful to include a pointer to a SSL testing service, such as https://www.ssllabs.com/ssltest/
Ideally, it'd be open-sourced on GitHub, so it can be verified and updated. The example that I gave above isn't open source, but it seems to be reasonably thorough, so it's a start.
bknowles commentedon Jun 9, 2015
How about we refer people to the tools at https://https.cio.gov/resources/ ?
;)
gbinal commentedon Jun 9, 2015
Would it make sense to do 2 variants - One for new sites and one for existing sites that need to transition?
Since the policy calls out the need for new sites to have from day one, that's a pressing use case that we should try to support as thoroughly and specifically as possible.
konklone commentedon Jun 9, 2015
Good call.
[-]Checklist-style page[/-][+]Compliance guide[/+]konklone commentedon Jun 30, 2015
Renaming this issue to focus on being a one-page Compliance Guide. It may well need to be broken out into two pages for new vs existing, but I suspect it won't be necessary.
This is where we'll put information about preloading vs subdomains, and describing/linking to the migration process.
konklone commentedon Nov 17, 2015
This got done in #133.