4

My Chrome (40.0.2214.115m) jumps to non-existent https :

I type in

http://johnwhitech.homeip.net:8080/

And Chrome redirect to

http s ://johnwhitech.homeip.net:8080/

which does not exist. I do not have HTTPS everywhere.

In network analyzer, I see that my server answered a 307 redirect which is not true (apache is configured correctly and does not gives this answer, other browsers don't redirect, HTTP packets loop perfectly normal).

I tried to log the request with fiddler, here is it :

CONNECT johnwhitech.homeip.net:8080 HTTP/1.1

Host: johnwhitech.homeip.net:8080

Connection: keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)

Chrome/40.0.2214.115 Safari/537.36

A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.

...

Other strange thing : in the HOST column of fiddler, if I try with firefox, I see my server name. With chrome, I only see "Tunnel to..." even for the very first request. The protocol is indeed HTTP (look at the beginning of the packet), but why on hearth my chromes sends a SSL "ClientHello" along with it ?

Is it a normal behavior ?

The only thing I see that might be related to SSL is that I installed a self-signed certificate, first via chrome settings, then system-wide. This certificate works well, but maybe since the domain name matches a certificate in the list, chromes tries SSL ?

Thanks folks !


EDIT3 : This behavior also happens without internet connectivity (cache cleared), so definitely not on the server-side


EDIT4 : What I see in the "NETWORK" tab of Chrome Dev Tools. The first entry is normal, the second entry is via HTTP which gets immediably redirected to HTTPS. This happens with no network connection, in particular the server is not sending HSTS.

http://i.stack.imgur.com/xfoxA.png

  • What software do you use on server? – Mike Minaev Mar 3 '15 at 15:48
  • Chrome does CONNECT because that’s how HTTPS works over (non-transparent) proxies. Incidentally, Fiddler is a proxy. You should instead focus on whether Apache does or does not send a redirect. Use Wireshark or tcpdump to analyze traffic on your server machine. – Daniel B Mar 3 '15 at 15:53
  • Thanks for the info about CONNECT. Edited, especially : also happens without internet connectivity. – lbarman Mar 3 '15 at 16:01
8

Chrome clearly states the reason: HSTS. HSTS, once received, sticks. This is an essential part of the concept. This means that if Chrome received a HSTS header from your server, even if only once, it will stick until it expires.

To check Chrome’s HSTS cache, go to chrome://net-internals/#hsts. From there, you can query the cache. Unless it reports “Not Found”, Chrome has a cached HSTS header from your page. To remove it, use the tool provided on the same page.

| improve this answer | |
  • Great ! it was this. Did not know that HSTS sticked, and I thought the "no caching" option of dev-tools was performing a clean state. Great input. For the record, I did not setup my Apache server to send HSTS, so it seems sufficient that at one point, an address is accessible via HTTPS for chrome to remember it and "force SSL" via HSTS later on. – lbarman Mar 3 '15 at 23:56
  • chrome://net-internals/#hsts is disabled in newer versions of crhome – tutuca Oct 10 '19 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.