StrictTransportSecurity | STS is a HTTP header which can be | TLS library

I'm working on getting a website running on a local apache webserver and encounter errors when I click on certain links in the website. Firefox displays an "unable to connect" error page and appends a https:// to the front of the URL.

I first thought it was a browser configurations issue and have tried all of the solutions suggested here: Firefox redirects to https

and here: How do I stop Firefox from forcing https:// on local development server?

Suggestions in those links that I've tried include:

• Clearing the cache
• Forgetting the website
• Using/not using private mode
• Setting up browser.fixup.fallback-to-https to false
• Setting network.stricttransportsecurity.preloadlist to false

I now think its some kind of SSL certificate issue. Pressing the information button next to the URL displays a message that says connection not secure

So, I made a certificate using openssl req -nodes -new -x509 -keyout server.key -out server.cert and imported it to Firefox's certificate manager.

My certificate is now visible under the Authorities tab. However, the Servers tab is still empty. When I try to add an exception it prompts me for a location. I've tried localhost, http://localhost and https://localhost, but in each case it says that it is unable to obtain identification for this website.

I would appreciate any suggestions or direction.

Thanks.

Update: 12/2/20

After further research, I still believe this is an SSL error. But I don’t believe that Firefox is causing it. I have followed a variety of tutorials such as these to no avail:

Getting Chrome to accept self-signed localhost certificate

How to create a self-signed certificate with OpenSSL

https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/

https://gist.github.com/cecilemuller/9492b848eb8fe46d462abeb26656c4f8

All of which contain roughly the same pattern of using openSSL commands to generate a CA in some file location and then placing it in Keychain Access and turning permissions on.

In each case, I am unable to get Firefox to load https pages or get it to recognize identification for local host in it’s Certificate Manager’s Servers tab.

I have also downloaded Chrome. I believe I am correct in saying that Chrome looks to Keychain Access for localhost certification, and though my localhost certification is there and is trusted, Chrome can’t access https pages either. This persists even when I change the configuration chrome://flags/#allow-insecure-localhost to enable.

Because both browsers (and Safari too) give the same error, I think this is not a browser issue. I now think that this error has to do with apache configurations, and though the tutorial I found here: https://gist.github.com/nrollr/4daba07c67adcb30693e was not effective, I will continue to pursue this idea.

As always, any thought or insights as to the origin of this issue would be valued.

I am Trying to Implement HSTS in play framework typesafe server using scala code.

I have updated the application.config file with below line :