24

I have a number of network devices that I access over HTTPS. However, they are self-signed certificates, so Chrome displays a warning page.

enter image description here

In earlier versions of chrome, I seem to remember an "add exception" button on this screen, or on the certificate's information window (if you clicked the HTTPS in the address bar). However, that has long since disappeared.

How can I add an exception for specific self-signed certificates in Chrome 28?

migrated from serverfault.com Aug 14 '13 at 22:08

This question came from our site for system and network administrators.

20
  1. Export the certificate from Chrome.

    • To view the certificate click Inspect on the page and go the the Tab Security: enter image description here
    • Now click on View Certificate and export the certificate by clicking on Copy to file... In the wizard choose Base 64 encoded .Cer. Now save the certificate on your Desktop. enter image description here
  2. Import the certificate into your trusted root certification authority store.

    • Go to Start | and run the command certmgr.msc.

    • Expand the tree to get to Trusted Root Certification Authorities | Certificates. Go to All Tasks, choose Import and import the certificate in question.

OR

  • In chrome settings search for Manage certificates. Click on it and import the certificate under Trusted Root certificate Authorities.

    enter image description here

  • 3
    Well, I imported the cert successfully, but when I refreshed the HTTPS page, it still showed the certificate warning. When I looked in the certificate manager, I couldn't find the imported certificate anywhere. – Force Flow Aug 14 '13 at 15:30
  • 1
    You still need to make sure the name matches the website address you are connecting to. You could edit your /etc/hosts file as one solution. – Quinten Aug 14 '13 at 15:40
  • 6
    I should say that the CN needs to match--can be an IP address or a hostname. – Quinten Aug 14 '13 at 15:43
  • 6
    Doesn't work anymore... – Mrchief Aug 17 '15 at 17:00
  • 1
    New Chrome: Open page "Inspector" - Pick 'Security' tab - pick 'View certificate' - Follow answer from there. – bshea Aug 15 '17 at 15:35
11

For Mac OS X:

Click on the Certificate icon in the address bar. Click on "Certificate Information", then drag and drop the certificate image to your desktop or any other folder.

Double click the cer file you've just saved, it will open in the Keychain Access.

Choose a keychain to store it (I think this step is specific to Yosemite), for example "login", and finally click "always trust".

If you're not being asked where to save it or if you should trust it, locate the newly added certificate (it should be at the top of your list), right click it, choose "get info" and then choose "Always trrust" in the Trust tab, under "When using this certificate".

UPDATE 25/2/2017

Chrome doesn't show the certificate options next to the URL, you now have to open the developer tools (Option + Command + i) and go to the "Security" tab. You can then click "View Certificate" and follow the above instructions from the drag and drop and onwards.

You can also enable the more direct certificate link again by following these instructions: How to view SSL Certificate details on Chrome?

  • 2
    This procedure does not work for my Synology NAS. I can confirm, that the certificat is imported into KeyChain. But I still get the same error message from Chrome. – BetaRide Apr 18 '15 at 6:32
  • I'm experiencing similar issues, as BetaRide, but I think this is down to the hostname of the cert, which is different to the name the cert was created with – Andrew Jul 26 '15 at 5:52
  • When I put the certificate in my "login" chain, it didn't make any difference. I had to put it in the chain for my username and changed the "Use Custom Settings" trust level to "Always Trust", which changed all of the other options to that setting, not just the one for "X.509 Basic Policy". – L S Aug 7 '15 at 16:51
  • Thanks for your comment @L S, hopefully it will help other users with the same issue ;-) – Capsule Aug 10 '15 at 7:49
  • Actually, you can leave it in the login keychain, right click it, choose "get info" and then choose "Always trrust" in the Trust tab, under "When using this certificate" – Capsule Oct 2 '15 at 5:46
0

For OS X, to do it from the command line:

sudo security add-trusted-cert -p ssl -d -r trustRoot -k ~/Library/Keychains/login.keychain selfsigned.crt

If you don't have a .crt file (selfsigned.crt in this command) already to reference, view the cert in Chrome and drag it to your desktop.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.