ds9, yes, "site certs the browser doesn't trust a CA for" is more accurate. You can find the exact details of HSTS and self-signed certs in the draft in section

ds9, yes, "site certs the browser doesn't trust a CA for" is more accurate. You can find the exact details of HSTS and self-signed certs in the draft in section 11.3[1]. I've updated the post to hopefully be more clear. [1] http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-14#section-11.3 http://tools.ietf.org/html/draft-ietf-websec-strict-transpor...