We have an intranet site with outdated (according to chrome) certificates


Is it possible to add an exception for url or domain?

I have tried importing cerificate from the server into chrome but chrome did not like it

  • You have one of two options. Fix the certificate so it is no longer considered a legacy certificate or downgrade to an earlier version of Chrome which does not include the change that makes your certificate invalid. Your current approach is only valid for untrusted certificates, but that wasn't the case, Chrome considers the certificate unsafe to use due to the cipher. – Ramhound May 9 '18 at 21:44

Chrome starting with v66 distrusts legacy Symantec certificates. The correct fix for this is to change the certificate chain installed on your server.

For exceptions and transition options, refer to the Google Enterprise Chrome guidance: Migrate from Symantec Certificates.

As a workaround in a Windows AD domain, you may be able to use the Chrome Enterprise Policy option to disable this certificate distrust with a GPO. EnableSymantecLegacyInfrastructure is the new policy added in v66. For details, see the documentation in the Chromium Policy List.

Just remember that this is temporary and will stop working with Chrome v73 on 1 Jan 2019, at which point all Symantec PKI will be completely distrusted.


The full answer for us was to fully remove all google chrome installations from all users and use firefox. Googles inability to recognize valid certificates until their expiration date is entirely unacceptable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.