Resolving HSTS Vuln on Bentley CAD License Management Web app.

Hello,

Has anyone had success resolving: HSTS Missing From HTTPS Server (Nessus plugin 84502)  for Bentley CAD License Management Web app?

On:

- Windows 2012r2 server (DVG-KSC-04)

- IIS 8

- HP vendor states it is a s/w (web) issue. 

So we tried below in web.config to no avail.  But we are not sure WHICH web.config to alter. Or should we just disable http 80 all together?  Thanks.

<system.webServer>

               <rewrite>

            <rules>

                <rule name="HTTP to HTTPS redirect" stopProcessing="true">

                    <match url="(.*)" />

                    <conditions>

                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />

                    </conditions>

                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}"

                        redirectType="Permanent" />

                </rule>

            </rules>

            <outboundRules>

                <rule name="Add Strict-Transport-Security when HTTPS" enabled="true">

                    <match serverVariable="RESPONSE_Strict_Transport_Security"

                        pattern=".*" />

                    <conditions>

                        <add input="{HTTPS}" pattern="on" ignoreCase="true" />

                    </conditions>

                    <action type="Rewrite" value="max-age=31536000" />

                </rule>

            </outboundRules>

        </rewrite>