239

I want to know if it's possible to disable the warning you get in Chrome when you try to go to some HTTPS site that doesn't have a trusted certificate.

I have a few sites in my bookmarks that use HTTPS but none of them have trusted certificates, so each time I visit them I manually have to click "Proceed anyway" in the warning and it's getting kind of annoying.

Is there any way to disable the warning or somehow add these sites to some kind of safe list?

Improve this question
3
  • 2
    Just in case, check your device date/time settings
    – Timo Huovinen
    Sep 12, 2013 at 20:23
  • 19
    The security interstitial bypass keyword mentioned by @Jeremy has been rotated, use thisisunsafe instead.
    – Mr Griever
    Jun 17, 2019 at 16:14
  • 1
    @sippa can you please change the accepted answer, because accepted answer doesn't work for alot of people and it has low amount of upvotes .
    – yaya
    Sep 9, 2020 at 4:47

9 Answers 9

Reset to default
45

When you use Chrome's Options > Manage Certificates > Import where are you placing the certificate? On the "Certificate Store" screen of the import, choose "Place all certificates in the following store" and browse for "Trusted Root Certification Authorities." Restart Chrome.

Improve this answer
13
  • 4
    doesn't work in Chromium 11.0.696.71 (86024) on Ubuntu 11.04 :(
    – Radu Maris
    Jun 10, 2011 at 13:58
  • 13
    Chrome asks me for a certificate's password: "Please enter the password that was used to encrypt this certificate file"
    – kachar
    Jun 3, 2013 at 12:51
  • 2
    First you'll need to export the SSL certificate (the untrusted one) from the site you want to add an exception for. You can do that by clicking the red padlock icon to the left of the URL. From here you get a drop down with a 'certificate information' link. Click that link, go to the 'details' tab and 'copy to file'. I used the default options, exported to my desktop and then followed as cornelius10 suggested. In settings -> advanced settings, there'll be an SSL section. Go there and import the certificate you just exported. Worked a treat for me.
    – Lukey
    Sep 25, 2014 at 7:42
  • 3
    I have tried this and other permutations suggested here and nothing works. I import the certificate but the message "Your connection is not private" is still shown. Is this still a valid solution?
    – Klas Mellbourn
    Apr 22, 2015 at 7:12
  • 10
    Six years later and Chrome has totally messed up self-signed certificates. I did just as you described, but it only changed the error message to NET::ERR_CERT_COMMON_NAME_INVALID
    – Alkanshel
    Aug 6, 2015 at 0:09
172

You can tell Chrome to ignore all SSL errors by passing the following at the command line:

--ignore-certificate-errors

I start Chrome from bash using this:

/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --ignore-certificate-errors &> /dev/null &

and it works great. Note that this should only be used for testing development websites, and should not be used by a typical end user.

Why? Because Chrome won't say anything about bad certs on "real" sites too! So only use this if you are a developer!

If you just want this for local SSL certificates, then you may be able to get away with just using this option in Chrome, allow-insecure-localhost:

chrome://flags/#allow-insecure-localhost

On a related note, if you want to create fully trusted self signed SSL certs for Chrome/Safari, you can find out how to do that here

Improve this answer
20
  • 4
    Works on Windows too!
    – Chaoix
    Apr 5, 2016 at 18:06
  • 11
    This should be the accepted answer - this is such a MUST KNOW answer, it's not even funny. Thanks Brad !
    – Danail Gabenski
    Jun 21, 2016 at 8:08
  • 3
    This was the solution I was looking for. Works on Windows. Must work on other platforms too. Just run the executable with the mentioned flag.
    – Srinivas Gollapudi
    Aug 18, 2016 at 11:56
  • 3
    @BradParks looks like I had some extra chrome.exe running that I had to force quit and then it worked for me again. I still get the "You are using an unsupported command-line flag: --ignore-certificate-errors. Stability and security will suffer." I really don't like to see things suffer, especially security. Is this going away at some point?
    – ScottN
    Dec 5, 2016 at 19:54
  • 3
    Cool! I think that warning will probably stay there forever, to ensure that people are aware that chrome is ignoring SSL certs. Otherwise someone could run a fake site with an invalid SSL cert, and change your Chrome launch config to ignore ssl certs, and Chrome would access it this way with no warnings whatsoever!
    – Brad Parks
    Dec 5, 2016 at 20:19
39

You can avoid the message for trusted sites by installing the certificate.

This can be done by clicking on the warning icon in the address bar, then click

"Certificate Information" -> Details Tab -> Copy to file

Save the certificate, then double click on the certificate file. On the certificate window that opens, click install certificate, then walk through the install.

The next time you go to the site it should work fine without errors.

Improve this answer
6
  • 1
    Hmm.. I've tried what you said on two sites but it doesn't seem to be working. Do you think I have to reboot after I installed the certificate?
    – sippa
    Aug 21, 2009 at 16:13
  • 3
    I also tried go into Options in Chrome and then Manage Certificates and import them that way. It says imported successfully but it doesn't show up in the list.
    – sippa
    Aug 21, 2009 at 16:35
  • In order for this to work, the certificate author must match the domain. Otherwise the Chrome does not consider imported certificate as safe.
    – Dejv
    Oct 12, 2015 at 13:04
  • There is no certificate information any more in recent browsers.
    – user1050755
    Apr 21, 2017 at 8:30
  • Yeah, it's still available within the security tab in the development console though.
    – chills42
    Apr 21, 2017 at 16:06
22

For Chrome on OSX, here's a relatively easy way to add the self-signed certificate to the system's Keychain, which is used by Chrome: Google Chrome, Mac OS X and Self-Signed SSL Certificates. No more annoying red warning screen! (I do wish Chromium would simplify adding the exception though.)

Improve this answer
6
  • Thank you. If you receive Error 100013 when adding it through Keychain Access, refer to this page: bit.ly/jBujt1
    – Chris Serra
    Jun 20, 2011 at 1:19
  • @ChrisSerra - I'm trying to follow your bitly link but get a 404; can you elaborate on what the instructions there were?
    – EmmyS
    Nov 1, 2011 at 16:08
  • @EmmyS: I'm sorry -- I really do not remember. Was trying to find the page in Google Cache, but was not successful. I'll try to review the process again, and see if muscle memory helps me recall the solution.
    – Chris Serra
    Nov 2, 2011 at 20:01
  • @ChrisSerra - no big deal; we did figure out how to do it.
    – EmmyS
    Nov 2, 2011 at 20:24
  • Thanks for the link. It worked. It seems that the certificate's CN must still match the url's domain even after these steps. Also Step 5 on that site is not needed. It can be added to your login keychain and doesn't need to be in the system keychain.
    – mhost
    Nov 8, 2012 at 8:08
15

Instructions for Linux (Chrome 12+):

Certificate Information -> Details -> Export

Save the certificate as a file of your choice.

Preferences -> Under the hood -> Manage certificates -> Authorities

Import the file and check all the boxes when it asks. You are done.

It is very important to import under the Authorities tab, and not other!

Improve this answer
4
  • 5
    The file contained one certificate, which was not imported: xxx.xxxxx.com: Not a Certification Authority.
    – kachar
    Jun 3, 2013 at 12:52
  • Well it looks like you dont have authority cert. Try different tab. The question is for authorities...
    – lzap
    Jun 3, 2013 at 13:36
  • 1
    Yep, it worked on tab 'Other certificates'
    – kachar
    Jun 4, 2013 at 20:37
  • If you have trouble finding the "Authorities" tab, just look for a header with that name under chrome://settings/certificates. (Sidenote: due to Material design, the tab doesn't look like a tab; instead it looks flat.)
    – Denilson Sá Maia
    Aug 3, 2020 at 16:49
4

On OsX you should export your certificate from firefox and import on keychain under the login profile.

Improve this answer
1
  • For some problems, you might need an extra step. In the keychain, doublick the certificate. In certificate window, there is 'Trust' accordion near the top. Open it. Change the 'When using this certificate' to 'Always Trust' and save the change.
    – Maksym
    Mar 20, 2020 at 15:32
3

If the Google paternalism becomes insufferable as in:

we don't want users to visit a site with a revoked certificate. If you think this bug report is about #2, I'll mark it WontFix. Would you like me to do that?

you can nullify the browser's TLS system completely by using a TLS proxy that signs all TLS connection opening with its own TLS root CA. Obviously, that has annoying consequences like the inability to view the real certificate of a website with the Chrome interface. Also, client TLS certificates are by design not compatible with that TLS proxying.

Many Google Chrome extensions allow you to select proxies based on domain, so you could only proxy those domains that are known to cause TLS issues in Chrome.

Improve this answer
1
  • Not trusting revoked certificates is a necessary part of public key cryptography. There needs to be a mechanism so that, for example, certs tied to compromised private keys are no longer trusted.
    – hayden.sikh
    Jan 6, 2021 at 22:16
1

In order for me to get this to work, I had to copy to file using the "Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B)" option and check the "Include all certificates in the certification path if possible" box.

Then I imported using Cornelius' instructions and it worked.

Improve this answer
1
  • 1
    This still gets me "NET::ERR_CERT_COMMON_NAME_INVALID"..
    – Alkanshel
    Aug 6, 2015 at 0:20
1

If the site to which you go, your own server, make sure that you have installed the Self-Signed certificate or a certificate from a Trusted Authorities on your server. Some server software sets the default test certificate, which can not be added to the Trusted root Authorities certificate store.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .