This weekend, we started using CloudFlare*. One of our users is reporting that Avast, the anti-virus software, has blocked our site due to a certificate error.Presumably this is because our certificate has changed -- we are now using the certificate CloudFlare provides, rather than our own. However, we do not have HTTP Strict Transport Security enabled. Does Avast, as a feature, enforce an HSTS-like policy even when none is called for?(* The situation is slightly more complicated: we started using our own CloudFlare account, having previously used the initial site developer's CF account -- obviously this required a change to DNS, CF certificates, and site external IP address(es).)
CloudFlare and Avast strict transport
https;security certificate;cloudflare;virus;hsts