I am trying to enable HTTP Strict Transport Security on a federation proxy server. I have enabled the headers module to the Apache HTTP Server and added set the response headers in the <VirtualHost> block in proxy-engine/conf/server.conf. The response headers are not being populated though. Any ideas? Should I be setting the headers through Tomcat instead?