1

I recently auto-updated my laptop (Macbook Pro with 10.6, it it matters) to Chrome 6. My current employer has an annoying firewall that intercepts all incoming traffic, mainly to filter non-work related sites (eyeroll). The problem is that they do this poorly for https sites.

Now, when I try to load up gmail, I get the following error:

SSL connection error.
Error 128 (net::ERR_SSL_UNSAFE_NEGOTIATION): 
The SSL renegotiation extension was missing from the secure handshake. 

What I suspect is happening is that the browser is trying to go to https://somesite, but hits the internal filter which doesn't handle the 'renegotiation' well, and causes this error. In Chrome 5, it would just give me a warning that something was insecure, but still display the page.

I won't be able to convince any admin to dial it down a notch or fix anything, so how can I turn off or temporarily disable that feature? I know and understand that a nefarious admin could monitor my session, but in this case I'm willing to accept the risk.

1 Answer 1

1

Copied from the Chrome help forums:

For Chrome 6 stable, renegotiation checks are disabled if you have a proxy configured. We are working with several SSL MITM proxy vendors in the mean time to address this. One of the most common, Blue Coat, have (or will very soon) release an update to their products which includes the needed security fix. Applying this is by far the best solution.

If your proxy is rewriting the TCP streams themselves then there is no way to distinguish this from an attack. In this case, adding --allow-ssl-mitm-proxies to the command line will disable this check and all other additional security measures that we have roadmapped in this area.

You'd have to enable this switch by launching Chrome from the Terminal and the command should read open /Applications/Google Chrome.app/Contents/MacOS/Google Chrome --allow-ssl-mitm-proxies (assuming you have Chrome in your /Applications folder.

3
  • Makes sense, and it is Blue Coat that is annoying me, but Chrome is telling me that the --allow-ssl-mitm-proxies switch is unrecognized. Chrome is in the /Applications folder. Version: 6.0.472.55
    – swilliams
    Sep 10, 2010 at 17:01
  • It may be a Windows-specific switch. Try it on the app itself? open /Applications/Google Chrome.app --allow-ssl-mitm-proxies
    – jsejcksn
    Sep 10, 2010 at 17:23
  • I figured it out. The open command is what was taking the switch (not chrome). Just executing /Applications/Google Chrome.app/Contents/MacOS/Google Chrome --allow-ssl-mitm-proxies runs it, though it requires the terminal window to stay open... So I created an AppleScript that wrapped it all up: gist.github.com/574049
    – swilliams
    Sep 10, 2010 at 17:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .