1

I have a droplet on digital ocean which was initially configured with only one domain (andrey.dev.br), it worked right out of the box after installing either Apache or Nginx without any extra configuration.

after some time I configured a second domain (raphaelvieira.dev) on the same droplet via digital ocean admin panel, the first weird behavior was that every time I tried to access the domain raphaelvieira.dev on the browser (chrome, firefox, etc), the browser automatically redirected it to https://raphaelvieira.dev, which is odd because I don't have a HTTPS configured on apache, but it works if I access it via terminal with curl, example:

curl htttp://raphaelvieira.dev

after some unsuccessful tries, I decided to add virtual hosts for the two domains, following this tutorial, the first one (andrey.dev.br) continued to work fine via browser access or curl, but the raphaelvieira.dev, when accessed from browser, started to return "www.raphaelvieira.dev took too long to respond.", but kept working via curl on terminal.

the raphaelviera.dev domain is registered on google domains.

why is this happening?

Thiago Dias
  • 113
  • 4
  • i installed https on apache and now the raphaelvieira.dev is working, seems like .dev domains must have https enabled, at least for direct browser access – Thiago Dias Jun 13 '21 at 23:20
  • "why is this happening?" When you bought your `.dev` domains the registrar had the obligation to show you a message (this is required by the registry, Google) explaining that `.dev` domains requires HTTPS as the whole TLD has been added to the HSTS preloading list. – Patrick Mevzek Jun 14 '21 at 14:35

1 Answers1

1

This is a known issue.

TLD .dev is forced to use HSTS, which means without SSL is not possible

Regarding https://get.dev/#get-started as Reference:

Your security is our priority. The .dev top-level domain is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages without needing individual HSTS registration or configuration. Security is built in.

So Enable and force SSL and also forgot any http on this as it will be useless on this kind of TLD.

djdomi
  • 1,599
  • 3
  • 12
  • 19