Last year we wrote about Google adding 45 TLDs to the HSTS preload list<\/a>, a move that effectively made them HTTPS-only. At the time only a handful of the TLDs were active and the move was almost entirely made with an eye towards the future. Well that future is now, Google is launching the .app TLD<\/a>, which will be 100% encrypted.<\/p>\n\n\n\n From now through May 7, you can register .app domains via Google\u2019s Early Access Program<\/a>.<\/span><\/p>\n\n\n\n For those that need a bit of background, a TLD is a top-level domain, it\u2019s what comes immediately after the domain name in a URL. Some common ones are:<\/p>\n\n\n\n “Prior to 2014, there were approximately 280 Top Level Domains delegated globally, with roughly 248 of them being country code top level domains, such as .co.uk, and 20 generic Top Level Domains, including .com, .net and .org,\u201d said The SSL Store EVP of Strategic Partnerships, Michael Ward, who has considerable experience in the domain name and domain registry industry \u2013 most recently working to launch the .eco TLD. \u201cThere are now several hundred top level domains available including .app that launched this week.”<\/p>\n\n\n\n Aside from being well-positioned as an obvious choice for app developers, .app is also one of the 45 TLDs Google added to the HSTS Preload list last year, meaning that it will be HTTPS only. Again, you may want some background. HSTS or HTTP Strict Transport Security<\/a> is a mechanism that ensures a web browser only makes secure HTTPS connections. This is important, because it eliminates a couple of attack vectors that could allow someone to strip a connection or hijack a session.<\/p>\n\n\n\n HSTS is done with an HTTP header though, which means that there\u2019s still a tiny window where a user is vulnerable upon the very first connection with a site, before downloading the header. The HSTS Preload list solves this, it is a running list of websites with HSTS headers that comes pre-downloaded on popular browsers and forces a secure connection the very first time. We recommend it to all of our customers.<\/p>\n\n\n\n With .app, Google has saved site owners a step and just gone ahead and added them to the preload list at the TLD level.<\/p>\n\n\n\n But, be warned, this is a double-edged sword. You are now obligated to use HTTPS with .app<\/a> domains<\/strong>\u2014they literally will not work without an SSL certificate. You will instead receive a browser error and your site will be inaccessible. And just one more time, so we’re clear: .app’s inclusion on the HSTS preload list doesn’t mean you won’t still need an SSL certificate. In fact, forced HSTS means now you need an SSL certificate more than ever.<\/p>\n\n\n\n\n
So, what makes the .app TLD so unique?<\/h2>\n\n\n\n