OH: Use add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; instead of add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; always";
I just did and restarted nginx.
Alright thanks for the help guys!
Just to close this off:
The problem was that the CORS if clause I had copied from http://enable-cors.org/server_nginx.html removed all other headers including my HSTS one. I had to move the headers outside the server scope and remove the if clauses to get it to work. Now it does 
Discussions here: http://serverfault.com/questions/764705/fix-headers-in-nginx-with-cors-and-http-2
letsencrypt is awesome! Truely!
2 Likes
Yes, right. Nginx uses just the headers from the most inner block, it’s annoying.
1 Like
Thanks guys! This was an awesome post, quite detailed and helped me allot in getting my SSL nice an secure. I am pretty sure many developers will love you for this as well! @dominikwilkowski, @kelunik
3 Likes