HTTP Strict Transport Security on ASA

[gchevalley]

Our PCI scan vendor has recently began flagging the outside interfaces of all of our firewalls that have AnyConnect enabled on them.  Does anyone know if there is a way to enable HSTS on AnyConnect / WebVPN or the outside interface?

[vse]

webvpn
 enable outside
 hsts
  enable
  max-age 31536000
  include-sub-domains
  no preload

[gunnar.gud]

Is there any way to prevent users from bypassing security issues (does HSTS work on Anyconnect itself?), such as cert errors or tls errors?