4

I have tried to open https://utox.io which has right now the following error:

  • SEC_ERROR_EXPIRED_CERTIFICATE (FireFox)
  • NET::ERR_CERT_DATE_INVALID (Chrome)
  • DLG_FLAGS_SEC_CERT_DATE_INVALID (Internet Explorer)

"https://" is forced by a redirect, so it is not possible to open it via "http://".

I don't want to submit any information there to this website (reading only), so actually I don't care about encryption in this case.

Why is it not possible to just click on a "I know the risk, go ahead" button?

Improve this question

2 Answers 2

Reset to default
5

It is not possible because browsers have become more strict about certificates. This website uses an elapsed certificate by Let's Encrypt, with which it's not possible to establish an https connection, so it's blocked.

To bypass this restriction, create a Chrome shortcut and add to it the parameter --ignore-certificate-errors. Chrome will give a warning on starting, but will open the website.

I remark that this workaround might also stop working in the future.

Improve this answer
10
  • Why is it then possible to go around a self-signed certificate warning (add exception), what is actually more risky?
    – Michael Uray
    Nov 9, 2018 at 17:04
  • This is an undocumented parameter, to use at your own risk. To use, you should be sure that this website is legit. Do not use this parameter in your regular work, only for accessing special websites.
    – harrymc
    Nov 9, 2018 at 17:07
  • 1
    Also, the reason the option isn't available is probably because the site uses HSTS. Without that, Chrome should either try to fall back to unencrypted HTTP, or at least offer the option of ignoring the certificate error.
    – Austin Hemmelgarn
    Nov 9, 2018 at 20:36
  • 1
    @harrymc My point was that Chrome may be a bit pickier about not letting you access the site with an invalid certificate because the site itself declares a requirement for encryption using HSTS (and it appears to be in the HSTS preload list, which means that Chrome already knew it used HSTS before you even tried to connect).
    – Austin Hemmelgarn
    Nov 12, 2018 at 15:11
  • 1
    @harrymc It's essentially what HSTS is asking for though, given that it indicates that users shouldn't be accessing the site over an insecure channel, and an invalid certificate means you don't have any security guarantees.
    – Austin Hemmelgarn
    Nov 12, 2018 at 16:43
0

In 2022, this works in Chrome/Canary:

open -na "Google Chrome Canary" --args --ignore-certificate-errors "https://cryptobin.co"
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .