firefox tries to open http subdomain as https [ nginx configuration ]

Solution 1:

That's what HSTS is supposed to do. Once a browser has visited the https version of a site and received the HSTS header back, it will always request the https version until the expiry date, which in your case is one year.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

And because you have includeSubDomains, subdomains are included.

To switch HSTS off, change the max-age to 1, request the https version again to cache the new header, wait 1 second then try the http version.

Or you could just remove includeSubDomains and then request the https version again to cache the header.