Correct, HSTS is a header that is passed by nginx&#x2F;Apache&#x2F;whatever combined with a hard coded list shipped with your browser. You need SSL for HSTS to work, but the SSL vendor you choose doesn&#x27;t have any bearing on being able to implement HSTS.