Support for HTTPS only with http-01 challenge?

My thoughts on this point:

  • Any user with a browser that has your site on the preload list is safe.
  • Any user who has previously visited your site and received the HSTS header is safe.
  • If someone's visiting your site using a browser that doesn't have a HSTS preload list (or doesn't support HSTS at all), and explicitly requests http://example.com, the information leak has already happened, independent of whether you listen on port 80 or not. In order to read that traffic, an attacker needs to be in a position to MitM a connection anyway - and if the attacker is in that position, he can easily listen on port 80 instead of you.

I don't see any additional risks in doing this, and it's a huge UX win for any users who accidentally visit the http:// version (who would otherwise think the site is down).