29

I have a number of network devices that I access over HTTPS. However, they are self-signed certificates, so Chrome displays a warning page.

enter image description here

In earlier versions of chrome, I seem to remember an "add exception" button on this screen, or on the certificate's information window (if you clicked the HTTPS in the address bar). However, that has long since disappeared.

How can I add an exception for specific self-signed certificates in Chrome 28?

Improve this question
3
  • Are you trying to get this done on multiple workstations or just yours?
    – rtf
    Commented Aug 14, 2013 at 15:23
  • Just a single workstation.
    – Force Flow
    Commented Aug 14, 2013 at 15:26
  • related: stackoverflow.com/questions/7580508/…
    – yms
    Commented Jun 7, 2016 at 20:28

3 Answers 3

Reset to default
23

  1. Export the certificate from Chrome.

    • To view the certificate click Inspect on the page and go the the Tab Security: enter image description here
    • Now click on View Certificate and export the certificate by clicking on Copy to file... In the wizard choose Base 64 encoded .Cer. Now save the certificate on your Desktop. enter image description here

  2. Import the certificate into your trusted root certification authority store.

    • Go to Start | and run the command certmgr.msc.

    • Expand the tree to get to Trusted Root Certification Authorities | Certificates. Go to All Tasks, choose Import and import the certificate in question.

OR

  • In chrome settings search for Manage certificates. Click on it and import the certificate under Trusted Root certificate Authorities.

    enter image description here

Improve this answer
9
  • 5
    Well, I imported the cert successfully, but when I refreshed the HTTPS page, it still showed the certificate warning. When I looked in the certificate manager, I couldn't find the imported certificate anywhere.
    – Force Flow
    Commented Aug 14, 2013 at 15:30
  • 1
    You still need to make sure the name matches the website address you are connecting to. You could edit your /etc/hosts file as one solution.
    – Quinten
    Commented Aug 14, 2013 at 15:40
  • 6
    I should say that the CN needs to match--can be an IP address or a hostname.
    – Quinten
    Commented Aug 14, 2013 at 15:43
  • 7
    Doesn't work anymore...
    – Mrchief
    Commented Aug 17, 2015 at 17:00
  • 1
    New Chrome: Open page "Inspector" - Pick 'Security' tab - pick 'View certificate' - Follow answer from there.
    – B. Shea
    Commented Aug 15, 2017 at 15:35
13

For Mac OS X:

Click on the Certificate icon in the address bar. Click on "Certificate Information", then drag and drop the certificate image to your desktop or any other folder.

Double click the cer file you've just saved, it will open in the Keychain Access.

Choose a keychain to store it (I think this step is specific to Yosemite), for example "login", and finally click "always trust".

If you're not being asked where to save it or if you should trust it, locate the newly added certificate (it should be at the top of your list), right click it, choose "get info" and then choose "Always trrust" in the Trust tab, under "When using this certificate".

UPDATE 25/2/2017

Chrome doesn't show the certificate options next to the URL, you now have to open the developer tools (Option + Command + i) and go to the "Security" tab. You can then click "View Certificate" and follow the above instructions from the drag and drop and onwards.

You can also enable the more direct certificate link again by following these instructions: How to view SSL Certificate details on Chrome?

Improve this answer
5
  • 3
    This procedure does not work for my Synology NAS. I can confirm, that the certificat is imported into KeyChain. But I still get the same error message from Chrome.
    – BetaRide
    Commented Apr 18, 2015 at 6:32
  • I'm experiencing similar issues, as BetaRide, but I think this is down to the hostname of the cert, which is different to the name the cert was created with
    – Andrew
    Commented Jul 26, 2015 at 5:52
  • When I put the certificate in my "login" chain, it didn't make any difference. I had to put it in the chain for my username and changed the "Use Custom Settings" trust level to "Always Trust", which changed all of the other options to that setting, not just the one for "X.509 Basic Policy".
    – Mr. Lance E Sloan
    Commented Aug 7, 2015 at 16:51
  • Thanks for your comment @L S, hopefully it will help other users with the same issue ;-)
    – Capsule
    Commented Aug 10, 2015 at 7:49
  • Actually, you can leave it in the login keychain, right click it, choose "get info" and then choose "Always trrust" in the Trust tab, under "When using this certificate"
    – Capsule
    Commented Oct 2, 2015 at 5:46
1

For OS X, to do it from the command line:

sudo security add-trusted-cert -p ssl -d -r trustRoot -k ~/Library/Keychains/login.keychain selfsigned.crt

If you don't have a .crt file (selfsigned.crt in this command) already to reference, view the cert in Chrome and drag it to your desktop.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .