Remove the "snionly" concept from the HSTS preload.

net/http/transport_security_state_static.json

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file contains the HSTS preloaded list in a machine readable format.
 
 // The top-level element is a dictionary with two keys: "pinsets" maps details
 // of certificate pinning to a name and "entries" contains the HSTS details for
 // each host.
 //
@@ skipping 200 matching lines @@
     { "name": "goto.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "cloud.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "glass.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "admin.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "login.corp.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     // play.google.com doesn't have include_subdomains because of crbug.com/327834.
     { "name": "play.google.com", "mode": "force-https", "pins": "google" },
     { "name": "passwords.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
 
     // Other Google-related domains that must use HTTPS.
+    { "name": "gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "m.gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "googlemail.com", "mode": "force-https", "pins": "google" },
+    { "name": "m.googlemail.com", "mode": "force-https", "pins": "google" },
+    { "name": "www.gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "www.googlemail.com", "mode": "force-https", "pins": "google" },
     { "name": "market.android.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "ssl.google-analytics.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "drive.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "googleplex.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "groups.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "apis.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "chromiumcodereview.appspot.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "chrome-devtools-frontend.appspot.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "codereview.appspot.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "codereview.chromium.org", "include_subdomains": true, "mode": "force-https", "pins": "google" },
@@ skipping 18 matching lines @@
     { "name": "wf-training-master.appspot.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "wf-dogfood-hrd.appspot.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
 
     // chart.apis.google.com is *not* HSTS because the certificate doesn't match
     // and there are lots of links out there that still use the name. The correct
     // hostname for this is chart.googleapis.com.
     { "name": "chart.apis.google.com", "include_subdomains": true, "pins": "google" },
 
     // Other Google-related domains that must use an acceptable certificate
     // iff using SSL.
+    { "name": "google-analytics.com", "include_subdomains": true, "pins": "google" },
+    { "name": "googlegroups.com", "include_subdomains": true, "pins": "google" },
     { "name": "ytimg.com", "include_subdomains": true, "pins": "google" },
     { "name": "googleusercontent.com", "include_subdomains": true, "pins": "google" },
     { "name": "youtube.com", "include_subdomains": true, "pins": "google" },
     { "name": "youtube-nocookie.com", "include_subdomains": true, "pins": "google" },
     { "name": "googleapis.com", "include_subdomains": true, "pins": "google" },
     { "name": "googleadservices.com", "include_subdomains": true, "pins": "google" },
     { "name": "appspot.com", "include_subdomains": true, "pins": "google" },
     { "name": "googlesyndication.com", "include_subdomains": true, "pins": "google" },
     { "name": "doubleclick.net", "include_subdomains": true, "pins": "google" },
     { "name": "2mdn.net", "include_subdomains": true, "pins": "google" },
@@ skipping 903 matching lines @@
     { "name": "reishunger.de", "include_subdomains": true, "mode": "force-https" },
     { "name": "salserocafe.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "samizdat.cz", "include_subdomains": true, "mode": "force-https" },
     { "name": "sslmate.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "steventress.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "tekshrek.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "temehu.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "tobias-kluge.de", "include_subdomains": true, "mode": "force-https" },
     { "name": "vortexhobbies.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "willnorris.com", "include_subdomains": true, "mode": "force-https" },
-
-    // Entries that are only valid if the client supports SNI.
-    { "name": "gmail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "googlemail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "www.gmail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "www.googlemail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "google-analytics.com", "include_subdomains": true, "pins": "google", "snionly": true },
-    { "name": "googlegroups.com", "include_subdomains": true, "pins": "google", "snionly": true },
-    { "name": "mykolab.com", "include_subdomains": true, "mode": "force-https", "snionly": true },
-    { "name": "semenkovich.com", "include_subdomains": true, "mode": "force-https", "snionly": true },
-    { "name": "rme.li", "mode": "force-https", "snionly": true },
-    { "name": "www.rme.li", "mode": "force-https", "snionly": true }
+    { "name": "mykolab.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "semenkovich.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "rme.li", "mode": "force-https" },
+    { "name": "www.rme.li", "mode": "force-https" }

[Ryan Sleevi, 2014/09/25 17:50:37]

What's the deal with these domains? Why'd we ever include them in the sni-only
list? Accident?

[agl, 2014/09/25 18:16:35]

There are sites that requested preloading but which only work with SNI.

   ]
 }