Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently auto-updated my laptop (Macbook Pro with 10.6, it it matters) to Chrome 6. My current employer has an annoying firewall that intercepts all incoming traffic, mainly to filter non-work related sites (eyeroll). The problem is that they do this poorly for https sites.

Now, when I try to load up gmail, I get the following error:

SSL connection error.
Error 128 (net::ERR_SSL_UNSAFE_NEGOTIATION): 
The SSL renegotiation extension was missing from the secure handshake. 

What I suspect is happening is that the browser is trying to go to https://somesite, but hits the internal filter which doesn't handle the 'renegotiation' well, and causes this error. In Chrome 5, it would just give me a warning that something was insecure, but still display the page.

I won't be able to convince any admin to dial it down a notch or fix anything, so how can I turn off or temporarily disable that feature? I know and understand that a nefarious admin could monitor my session, but in this case I'm willing to accept the risk.

share|improve this question

1 Answer 1

Copied from the Chrome help forums:

For Chrome 6 stable, renegotiation checks are disabled if you have a proxy configured. We are working with several SSL MITM proxy vendors in the mean time to address this. One of the most common, Blue Coat, have (or will very soon) release an update to their products which includes the needed security fix. Applying this is by far the best solution.

If your proxy is rewriting the TCP streams themselves then there is no way to distinguish this from an attack. In this case, adding --allow-ssl-mitm-proxies to the command line will disable this check and all other additional security measures that we have roadmapped in this area.

You'd have to enable this switch by launching Chrome from the Terminal and the command should read open /Applications/Google Chrome.app/Contents/MacOS/Google Chrome --allow-ssl-mitm-proxies (assuming you have Chrome in your /Applications folder.

share|improve this answer
    
Makes sense, and it is Blue Coat that is annoying me, but Chrome is telling me that the --allow-ssl-mitm-proxies switch is unrecognized. Chrome is in the /Applications folder. Version: 6.0.472.55 –  swilliams Sep 10 '10 at 17:01
    
It may be a Windows-specific switch. Try it on the app itself? open /Applications/Google Chrome.app --allow-ssl-mitm-proxies –  pattern86 Sep 10 '10 at 17:23
    
I figured it out. The open command is what was taking the switch (not chrome). Just executing /Applications/Google Chrome.app/Contents/MacOS/Google Chrome --allow-ssl-mitm-proxies runs it, though it requires the terminal window to stay open... So I created an AppleScript that wrapped it all up: gist.github.com/574049 –  swilliams Sep 10 '10 at 17:42
    
Nice! Thanks for the link, too. –  pattern86 Sep 10 '10 at 18:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.