Remove the "snionly" concept from the HSTS preload.

net/http/transport_security_state_static.json

Index: net/http/transport_security_state_static.json
diff --git a/net/http/transport_security_state_static.json b/net/http/transport_security_state_static.json
index ae87cb40a4b5d53231401f526af451d33179d9b3..98b5b6f9ddda99fd3a3f6ad7006b6e093516dc2b 100644
--- a/net/http/transport_security_state_static.json
+++ b/net/http/transport_security_state_static.json
@@ -218,6 +218,12 @@
     { "name": "passwords.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
 
     // Other Google-related domains that must use HTTPS.
+    { "name": "gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "m.gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "googlemail.com", "mode": "force-https", "pins": "google" },
+    { "name": "m.googlemail.com", "mode": "force-https", "pins": "google" },
+    { "name": "www.gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "www.googlemail.com", "mode": "force-https", "pins": "google" },
     { "name": "market.android.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "ssl.google-analytics.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
     { "name": "drive.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
@@ -256,6 +262,8 @@
 
     // Other Google-related domains that must use an acceptable certificate
     // iff using SSL.
+    { "name": "google-analytics.com", "include_subdomains": true, "pins": "google" },
+    { "name": "googlegroups.com", "include_subdomains": true, "pins": "google" },
     { "name": "ytimg.com", "include_subdomains": true, "pins": "google" },
     { "name": "googleusercontent.com", "include_subdomains": true, "pins": "google" },
     { "name": "youtube.com", "include_subdomains": true, "pins": "google" },
@@ -1179,17 +1187,9 @@
     { "name": "tobias-kluge.de", "include_subdomains": true, "mode": "force-https" },
     { "name": "vortexhobbies.com", "include_subdomains": true, "mode": "force-https" },
     { "name": "willnorris.com", "include_subdomains": true, "mode": "force-https" },
-
-    // Entries that are only valid if the client supports SNI.
-    { "name": "gmail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "googlemail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "www.gmail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "www.googlemail.com", "mode": "force-https", "pins": "google", "snionly": true },
-    { "name": "google-analytics.com", "include_subdomains": true, "pins": "google", "snionly": true },
-    { "name": "googlegroups.com", "include_subdomains": true, "pins": "google", "snionly": true },
-    { "name": "mykolab.com", "include_subdomains": true, "mode": "force-https", "snionly": true },
-    { "name": "semenkovich.com", "include_subdomains": true, "mode": "force-https", "snionly": true },
-    { "name": "rme.li", "mode": "force-https", "snionly": true },
-    { "name": "www.rme.li", "mode": "force-https", "snionly": true }
+    { "name": "mykolab.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "semenkovich.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "rme.li", "mode": "force-https" },
+    { "name": "www.rme.li", "mode": "force-https" }

[Ryan Sleevi, 2014/09/25 17:50:37]

What's the deal with these domains? Why'd we ever include them in the sni-only
list? Accident?

[agl, 2014/09/25 18:16:35]

There are sites that requested preloading but which only work with SNI.

   ]
 }