HSTS not working on subdomain

I have on the server the software: Ubuntu 18.04.2 LTS with nginx/1.14.0 (Ubuntu) installed with use apt-get. Nginx has modules:

Code:

root@hodor:/etc/nginx/sites-enabled# nginx -V 2>&1 | tr -- - '\n' | grep module
modules
path=/usr/lib/nginx/modules
http_ssl_module
http_stub_status_module
http_realip_module
http_auth_request_module
http_v2_module
http_dav_module
http_slice_module
http_addition_module
http_geoip_module=dynamic
http_gunzip_module
http_gzip_static_module
http_image_filter_module=dynamic
http_sub_module
http_xslt_module=dynamic
stream_ssl_module
mail_ssl_module

I have there two websites: subdomain.example.com and subdomain2.example.com. Both use own vhost file with the same ssl part:

Code:

    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
    ssl_prefer_server_ciphers on;

    # HSTS
    add_header Strict-Transport-Security "max-age=31536000";

    # XSS Protection
    add_header X-XSS-Protection "1; mode=block";

    # Clickjacking
    add_header X-Frame-Options "SAMEORIGIN";

    # X-Content Type Options
    add_header X-Content-Type-Options nosniff;

    # OCSP Stapling
    # fetch OCSP records from URL in ssl_certificate and cache them
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/letsencrypt/live/subdomain.example.com/chain.pem; //subdomain2.example.com has own LE ssl certificate

    ssl_certificate /etc/letsencrypt/live/subdomain.example.com/fullchain.pem; # managed by Certbot //subdomain2.example.com has own LE ssl certificate
    ssl_certificate_key /etc/letsencrypt/live/subdomain.example.com/privkey.pem; # managed by Certbot //subdomain2.example.com has own LE ssl certificate

Both websites have added HSTS header but only one works (ssllabs.com --> grade A+ "HTTP Strict Transport Security (HSTS) with long duration deployed on this server." but on second one is grade A without this message). Moreover for subdomain with grade A+ there is an information "This site works only in browsers with SNI support." but this with grade A does not have this message. I really don't understand what happens here. Nginx has default config.

 

Did you certificate is generate for both domains?

 

No, I did

Code:

certbot --nginx -d subdomain.example.com -d www.subdomain.example.com

for first and

Code:

certbot --nginx -d subdomain2.example.com -d www.subdomain2.example.com

for second website. Moreover there are also two separate directories inside /etc/letsencrypt/live.
PS
Both websites use own vhost file with the same ssl part as I mentioned earlier.