21

I'm building a site to replace an older site. The newer site currently is NOT HTTPS. However, the old site is HTTPS. I'm switching between the two sites by toggling an entry in my 'hosts' file.

I occasionally need to access the old site. When I do, it forcibly redirects to https://, but when I switch back to the new site, Chrome is then broken and will not let me get to http:// to the site but forcibly redirects to https:// which gives me the obvious "Privacy Error" warning and screws up a number of other things (it's WordPress, so it asks me to re-login, but I can't).

How the heck can I force Chrome to stop redirecting to https://? I tried chrome://net-internals/#hsts and I deleted the domain security policies for the site, but it seems to do absolutely nothing. Chrome still redirects. I also tried refreshing clearing cache - this doesn't work either.

9
  • Is your site HSTS preloaded? hstspreload.org Jan 30, 2019 at 18:12
  • No, it's not preloaded. Sorry, I updated the question. Check it again for more clarity.
    – Codesmith
    Jan 30, 2019 at 18:18
  • Have you considered the possibility of using another browser? Jan 30, 2019 at 18:31
  • Well, I would have figure Firefox wouldn't be as frustrating, but it seems to do the same thing. Maybe there's an extension or a flag or something for Firefox to get around this?
    – Codesmith
    Jan 30, 2019 at 18:42
  • 1
    See this. Jan 30, 2019 at 19:02

6 Answers 6

13

I found it !! I found it !!

For me, I had to perform this extra step :

  • Click on the icon of HTTPS on the left of the URL bar, and choose "Settings for this site".
  • Scroll and find "Secured content" (with the /!\ icon), and choose "Allow".

Thats all !

All the steps combined, give this :

  1. In chrome://net-internals/#hsts, in the "Delete domain security policies", enter the domain of the page, and click "Delete".
  2. Push CTRL+H, and delete all history/cache/cookies.
  3. On the page causing problem, click on the HTTPS icon on the top left of the URL bar, and choose "Settings for this website" (I'm French, I don't know the exact label in english versions).
  4. Scroll and find "Secured content", and choose "Allow".
  5. Go back to your page, remove the "s" of the https:// in the URL (it has been added again automatically since the last time it failed).
  6. Press enter to apply the URL. It should work :)
  7. If not, relaunch the browser.
2
  • 2
    Thanks @Héraès! This actually seems to work! p.s. The option name is "Insecure Content" in English. Also, for step 2, clearing just "Cached images and files" seems to do the trick. Not sure why..
    – Codesmith
    Aug 25, 2022 at 18:26
  • In fact, maybe it's just my test case right now, but it appears that all I have to do is clear "Cached images and files" and it works.. ?
    – Codesmith
    Aug 25, 2022 at 18:35
10

I have been able to get around this by deleting the domain security policy for the domain:

Go to chrome://net-internals/#hsts
Go towards the end and enter your domain in this textbox and hit delete.

Delete domain security policies Input a domain name to delete its dynamic domain security policies (HSTS and Expect-CT). (You cannot delete preloaded entries.):

Domain: example.com

1
  • Also note the "Query" section in that page can help you identify problem policies before just blanket deleting them. Dec 17, 2020 at 14:47
4

Just deleting the domain security policies using chrome://net-internals/#hsts will not make this work. You have to delete your browsing history and make sure the cache is cleared. Should work after that.

3
  • Had the same issue. This solution worked for me!
    – tzelleke
    Sep 23, 2020 at 16:25
  • FTR: to test if it would work for you without having to reset your browsing history, run a browser like HOME=/tmp/ google-chrome. So it will temporarily use /tmp dir as HOME, and of course it has no configs or history.
    – Hi-Angel
    Jul 26, 2022 at 21:37
  • I'd just copy the TLS certificate to the test server and use HTTPS there as well.
    – Bachsau
    Apr 29 at 1:34
2

In my case, this was because a superdomain of my domain had HSTS enabled. You can check this by going to chrome://net-internals/#hsts and entering your domain under "Query HSTS/PKP domain". If this is the case, you'll see something like

dynamic_sts_domain: example.com
dynamic_upgrade_mode: FORCE_HTTPS
dynamic_sts_include_subdomains: true
0
2

Starting a new incognito window will give an immediate workaround of the problem. Also handy if You do not want to clear Your history.

1
  • Strangely, it worked once, then stopped, so, even, incognito does not help. Only the "Insecure content" solution from superuser.com/a/1738799/161057 works, not in the incognito mode.
    – imy
    2 days ago
0

If you're a developer, go to chrome://net-internals/#hsts Then, at the bottom of the page "Delete domain security policies", simply type in "localhost" into the box and click [Delete]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .