79

I have searched for a way to do this and never found a good answer, though there have been tickets created in the past (#142818 & #405549).

Apparently, the chromium devs never created a chrome://flags override for "broken" SSL with password saving. This would seem to be the easiest way to fix this annoying "feature" (via flags). I DO understand completely why they block it by default.

Since there is no override to my knowledge, I had assumed that you would need to import the given self-signed certificate to a trusted root area in (Windows) store. This does not appear to work either.

Has anyone been able to get this to work? I can live with the warning - just not the lack of password saving. I spend most of my workday in a dev environment and need to keep re-entering passwords dozens of times a day (copy/paste).

EDIT (20 Feb 2023)
Please note Firefox DOES save and offer a password once you get past the warning/exempt site page. This Question is strictly in regards to Chrome. There is still no way to allow this similar to Firefox as far as I know (via flags or an exempt sites 'list').

Improve this question
5
  • Importing your self-signed cert into the Windows certificate store does work for Chrome, I do this all time. How are you importing it and into which store?
    – heavyd
    Aug 15, 2017 at 16:08
  • Last attempt - Import self-signed .cer format into "Trusted Root Cert Auths./Certificates"
    – B. Shea
    Aug 15, 2017 at 19:51
  • Not to state the obvious, but wouldn't be a bit easier if Chrome just added a flag override for us? Anyway, if you can point me in right direction or tell me what I am doing wrong please do :)
    – B. Shea
    Aug 15, 2017 at 20:00
  • Importing your self-signed cert into the Windows certificate store does not work for me, too
    – Ivan
    Jan 19, 2018 at 10:01
  • Update - I have never found an easy way/flag to do this as of date of this comment. But, with advent of free certificate issuance (LetsEncrypt/etc), my password saving problem's have been slowly going away as most times I can just create a legitimate SSL certificate. Problem solved. Note: The web server (during cert issuance) and client browser needs access to Internet, though. Which usually isn't an issue..
    – B. Shea
    Feb 3, 2020 at 15:27

6 Answers 6

Reset to default
37

I did not know about this option before today, but it appears that Chrome does have a flag for allowing insecure certificates from the localhost origin. This option is available from the chrome://flags/#allow-insecure-localhost page:

Screenshot

This will only help you for self-signed certificates on the localhost origin, and I have not tested it to see if it actually fixes your problem with the password manager, but it looks promising.

Improve this answer
7
  • 2
    @bshea, FYI hovering over the "answered XX minutes/hours/days ago" label will display and exact timestamp.
    – heavyd
    Aug 16, 2017 at 15:31
  • 2
    I wish chrome flags would support a complete override on cert checks (or specifically password saving from non-localhost source). There is a nice warning about using flags.. so I don't see why they don't. Liability i guess.
    – B. Shea
    Aug 16, 2017 at 19:33
  • 1
    @bshea, yeah I think they're trying to be security conscious. If the flag is there, then lazy website owners or malicious actors may instruct users to go flip the flag to enable their bad practices. If the flag is not there, there is no bypass
    – heavyd
    Aug 16, 2017 at 20:17
  • This didn't work for me. What worked for me was to generate a self-signed certificate and adding it to the system truststore as always trusted.
    – Vic Seedoubleyew
    Jun 10, 2019 at 17:28
  • 3
    This doesn't answer the question. It works on localhost but not with expired certificates on the internet.
    – Bachsau
    Nov 24, 2019 at 15:38
19

Alternatively, you can start Chrome with a command line switch --unsafely-treat-insecure-origin-as-secure="http://example.com" or go to chrome://flags/#unsafely-treat-insecure-origin-as-secure and enter your unsafe origin, e.g. http://example.com.

Improve this answer
3
  • Nice. Hadn't seen that flag/switch before. Can you also save a password for that 'bad ssl' domain?
    – B. Shea
    Jan 23, 2019 at 23:13
  • 3
    Didn't work for me either. I had to generate a self signed certificate and add it to system truststore
    – Vic Seedoubleyew
    Jun 10, 2019 at 17:29
  • 7
    I don't think this is for SSL/TLS at all. The secure origin policy is about cross site scripting, not encryption and authentification.
    – Bachsau
    Nov 24, 2019 at 15:40
6

Navigate to chrome://flags/#allow-insecure-localhost.

Then click "Enable".

Just be extremely wary that this is a major security flaw.

Edit: Linking to chrome://flags/ no longer works due to the fact that Chrome no longer allows hyperlinks to the Chrome protocol due to security regarding the use of url encoding in hyperlinks to the protocol. Certain url-encoded strings would crash older versions of Chrome. Rather than fixing this issue, they completely eliminated the option for hyperlinks. So just navigate to that location by copying and pasting the link.

Improve this answer
2
  • That flag is news to me. Not quite what i needed (localhost only), but it will certainly help.. Thanks.
    – B. Shea
    Aug 16, 2017 at 14:55
  • just FYI - the link doesn't work
    – redbeam_
    Jun 19, 2019 at 15:10
2

i suggest you to use macro (iMacros) instead break the security default of chrome and that's better to protect you from virus

edit:

  • download iMacros chrome extension
  • install it
  • create chrome new tab
  • open i macros
  • then move To record section and press record
  • at new tab go to login page
  • fill your username and password
  • press login
  • then stop record and save page

and voila now you can play your recorded macro in bookmark section to login effortlessly

Improve this answer
1
  • 1
    Welcome to Super User! Could you edit your answer to make it clear how it is answering the question?
    – Glorfindel
    Feb 24, 2019 at 13:06
1

None of these worked for me, I ended up following a combination of the powershell answers from here adding the -NotAfter flag as well, slightly modified to use copy and paste from comments instead of exporting the cert. Once I had all this working for the correct domains, chrome stopped saying the cert was invalid and prompted to save password.

To Create the new certificate for your specific domain:

Open Powershell ISE as admin, run the command:

New-SelfSignedCertificate -DnsName *.mydomain.com, localhost -CertStoreLocation cert:\LocalMachine\My

To trust the new certificate:

  • Open mmc.exe
  • Go to Console Root -> Certificates (Local Computer) -> Personal
  • Select the certificate you have created, copy
  • Go to Console Root -> Certificates -> Trusted Root Certification Authorities, paste

To bind the certificate to your site:

  • Open IIS Manager
  • Select your site and choose Edit Site -> Bindings in the right pane
  • Add new https binding with the correct hostname and the new certificate
Improve this answer
1
  • creating a new ceritifcate is no solution when someone asks how to solve it on the client. Manys times people dont have access to the server, but need to use internal services with no proper ssl cert for many reasons.
    – Henning
    Feb 10, 2022 at 20:21
0

chrome://flags/#legacy-tls-enforced

Whit this chrome flag set to disabled chrome ignore security enforcement and enable password manager on tls 1.0 sites too.

Improve this answer
2
  • 3
    This answer could really use some explanation.
    – Stephen Rauch
    Jan 9, 2021 at 16:20
  • 2
    While this does indeed allow login to sites with self-signed certs, without going through the annoying "yeah, yeah I know I'm going to an unsecured page" page - but in my tests, it does not allow passwords on those sites to be saved.
    – fsteff
    Apr 29, 2021 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .