Suppose that my site is located at foo.example.com and I send the following HTTP header when visitors accessing my site using HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains


Would the HSTS policy have any effect on domains such as example.com or bar.example.com?

I'm not in charge of the certificates but the common name is *.example.com on the certificate so I'm not sure if that matters.

The certificate isn't valid for abc.foo.example.com, but I imagine that if there is a valid cert for such a host that the HSTS policy would apply there.

Based on the RFC, HTTP Strict Transport Security (HSTS), the includeSubDomains states:

6.1.2.  The includeSubDomains Directive

The OPTIONAL "includeSubDomains" directive is a valueless directive
which, if present (i.e., it is "asserted"), signals the UA that the
HSTS Policy applies to this HSTS Host as well as any subdomains of
the host's domain name.
Therefore your HSTS policy would only apply to foo.example.com and *.foo.example.com
example.com and bar.example.com would not be impacted.
For more info, there is a great thread on webmasters titled Do I need a wildcard SSL certificate for inclusion in the HSTS preload list?
