Your browser will do that even without HSTS, but that spec prevents the browser from accepting no cert

Comments