Disabling HSTS for webservers under pfsense network

[khmadhu]

Hi
We have 2 pfsense server synced, and under this network we have 3 webservers load-balanced by pfsense, we use 2.2.2 version and I would like to know how to disable HSTS that forces https for the load-balanced webservers, the webservers run apache, we have tried adding

Header always set Strict-Transport-Security "max-age=0; includeSubDomains"

in apache2.conf file but still it forces for https!

Please let us know how to disable HSTS, never mind if I have to change core part of pfsense, any hint or clue to change any file would also be helpful.

[doktornotor]

There is no HSTS forced anywhere in the (completely unsupported) pfSense 2.2.2. For help with Apache configuration, you need to go to another forum. And once the client has hit the webserver, no amount of messing with the headers server-side will undo it, it will be cached and forced by the browser for the original max-age period.