How do I disable the warning Chrome gives if a security certificate is not trusted?

180

I want to know if it's possible to disable the warning you get in Chrome when you try to go to some HTTPS site that doesn't have a trusted certificate.

I have a few sites in my bookmarks that use HTTPS but none of them have trusted certificates, so each time I visit them I manually have to click "Proceed anyway" in the warning and it's getting kind of annoying.

Is there any way to disable the warning or somehow add these sites to some kind of safe list?

sippa

Posted 2009-08-21T15:43:18.083

Reputation: 2 059

1You could just type badidea anywhere on the page when you see the warning (only do this on sites you know are not compromised). You may have to do it a few times but you will see that works just fine. – Jeremy – 2017-12-22T03:39:33.603

2The security interstitial bypass keyword mentioned by @Jeremy has been rotated, use thisisunsafe instead. – Mr Griever – 2019-06-17T16:14:42.090

2Just in case, check your device date/time settings – Timo Huovinen – 2013-09-12T20:23:10.323

Answers

sippa,
When you use Chrome's Options > Manage Certificates > Import where are you placing the certificate? On the "Certificate Store" screen of the import, choose "Place all certificates in the following store" and browse for "Trusted Root Certification Authorities." Restart Chrome. This normally works for me.

cornelius10

Posted 2009-08-21T15:43:18.083

Reputation:

@kachar try selecting authorities or servers tab as in here: https://code.google.com/p/chromium/issues/detail?id=90563#c6

– sennett – 2014-08-27T13:20:10.937

1First you'll need to export the SSL certificate (the untrusted one) from the site you want to add an exception for. You can do that by clicking the red padlock icon to the left of the URL. From here you get a drop down with a 'certificate information' link. Click that link, go to the 'details' tab and 'copy to file'. I used the default options, exported to my desktop and then followed as cornelius10 suggested. In settings -> advanced settings, there'll be an SSL section. Go there and import the certificate you just exported. Worked a treat for me. – Lukey – 2014-09-25T07:42:30.267

3I have tried this and other permutations suggested here and nothing works. I import the certificate but the message "Your connection is not private" is still shown. Is this still a valid solution? – Klas Mellbourn – 2015-04-22T07:12:03.763

9Six years later and Chrome has totally messed up self-signed certificates. I did just as you described, but it only changed the error message to NET::ERR_CERT_COMMON_NAME_INVALID – Amalgovinus – 2015-08-06T00:09:39.023

1@Amalgovinus: Can you please make a group who understand Chrome totally messed up self-signed certificates? And make a debate to let Chrome understand how much they screwed up about this ? – YumYumYum – 2016-04-06T12:31:52.290

1They finally fixed the "stickiness" of this error a few months ago. It was pretty dumb that they changed the bypass phrase on that warning screen from "danger" to "badidea" though... essentially hiding the browser's functionality in easter eggs.. also pretty dumb – Amalgovinus – 2016-04-06T16:43:38.223

Google's "Manager Certificates" screen is a wrapper around Window's Certificate Manager (certmgr.msc). Both expose the same underlying concept: if you want to trust an untrusted certificate, you trust it by added it to the trusted store. – Ian Boyd – 2010-06-02T14:02:05.063

@BradParks below should be the accepted answer. While this may have been what the user was looking for, it doesn't answer the question as asked, which is important for questions searched on this web site. This answers how do I trust a certificate – reads0520 – 2018-08-28T16:51:56.650

4doesn't work in Chromium 11.0.696.71 (86024) on Ubuntu 11.04 :( – Radu Maris – 2011-06-10T13:58:49.807

Thanks! It works now when I imported to Trusted Root Certification Authorities like you said. I do hope they make it easier/faster to add sites to a safelist though. – sippa – 2009-09-16T14:11:59.097

These is now found by clicking "THree lines icon in upper right->Settings->Search box in upper right type "certi"->Manage Certificates... – AaronLS – 2012-10-11T21:45:34.547

13Chrome asks me for a certificate's password: "Please enter the password that was used to encrypt this certificate file" – kachar – 2013-06-03T12:51:13.877

112

You can tell Chrome to ignore all SSL errors by passing the following at the command line:

--ignore-certificate-errors

I start Chrome from bash using this:

/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --ignore-certificate-errors &> /dev/null &

and it works great. Note that this should only be used for testing development websites, and should not be used by a typical end user.

Why? Because Chrome won't say anything about bad certs on "real" sites too! So only use this if you are a developer!

If you just want this for local SSL certificates, then you may be able to get away with just using this option in Chrome, allow-insecure-localhost:

chrome://flags/#allow-insecure-localhost

On a related note, if you want to create fully trusted self signed SSL certs for Chrome/Safari, you can find out how to do that here

Brad Parks

Posted 2009-08-21T15:43:18.083

Reputation: 1 775

3Works on Windows too! – Chaoix – 2016-04-05T18:06:03.673

7This should be the accepted answer - this is such a MUST KNOW answer, it's not even funny. Thanks Brad ! – Danail Gabenski – 2016-06-21T08:08:39.693

3This was the solution I was looking for. Works on Windows. Must work on other platforms too. Just run the executable with the mentioned flag. – Srinivas Gollapudi – 2016-08-18T11:56:19.653

1+1 This should be the accepted answer. – Trevor Sullivan – 2016-11-07T20:37:17.633

1Did this switch stop working for any of you? Chrome was giving me "unsupported command line switch" message for a while, now it seems that they pulled the plug and this doesn't work anymore or maybe Chrome warns you X amount of times then completely blocks it? – ScottN – 2016-12-05T16:40:06.007

@ScottN - I just tried it and it still works for me. I did test it using Canary though, but my Canary is fully up to date. I tested it using badssl.com, which is managed by the chromium team for testing bad SSL certs, and is available on Github

– Brad Parks – 2016-12-05T18:02:12.227

2@BradParks looks like I had some extra chrome.exe running that I had to force quit and then it worked for me again. I still get the "You are using an unsupported command-line flag: --ignore-certificate-errors. Stability and security will suffer." I really don't like to see things suffer, especially security. Is this going away at some point? – ScottN – 2016-12-05T19:54:36.153

3Cool! I think that warning will probably stay there forever, to ensure that people are aware that chrome is ignoring SSL certs. Otherwise someone could run a fake site with an invalid SSL cert, and change your Chrome launch config to ignore ssl certs, and Chrome would access it this way with no warnings whatsoever! – Brad Parks – 2016-12-05T20:19:55.567

2@BradParks excellent point! – ScottN – 2016-12-05T22:06:57.630

I am not sure this is working on mac OS, I still get the working screen even if I run chrome using this command, I think it is related to the current session and you will get the that warning screen every chrome session, in other words you will have to allow it manually everytime you going to run chrome. – talsibony – 2017-03-20T09:53:42.953

@talsibony - for this to work, you have to completely shut down chrome, then start it again using the command line arguments listed above... I think if you do that you'll get it working as you'd expect. I just tried it on my mac and it worked for me! – Brad Parks – 2017-03-20T11:52:18.217

not workoing anymore since Chrome for Windows >58 ;( – TouDick – 2017-03-22T11:07:42.087

@TouDick - I just tried this in Chrome for Windows (v 57, up to date as of now), and it worked fine still. I tried it by going to https://expired.badssl.com and it didn't fail, but did fail when I started it without this command line option. My shortcut in Windows has this for "target", "C:\Program Files\Google\Chrome\Application\chrome.exe" --ignore-certificate-errors. I see you were using v58, though I don't see how to get that version, as I just updated Chrome, and it says "it's up to date".

– Brad Parks – 2017-03-22T11:37:23.773

Not working on Chrome v60 - Mac. – Eng.Fouad – 2017-08-15T15:56:07.460

@Eng.Fouad - I just tried it on a Mac, Chrome Version 60.0.3112.101 (Official Build) (64-bit) and it worked for me. I tested it using this site which has an invalid SSL cert and it skipped the warning, though it displayed the warning before I started chrome using that command line option. Make sure you have completely closed Chrome before trying to start it using that command line option, or it wont work.

– Brad Parks – 2017-08-15T17:28:27.000

1@BradParks You are right. I tried it one more time and it worked. Maybe I didn't close Chrome properly. – Eng.Fouad – 2017-08-15T18:18:12.740

Yeah it's easy to miss that... good to hear! – Brad Parks – 2017-08-15T18:59:35.323

1@BradParks your tip to "allow invalid certificates for resources loaded from localhost" did the trick for! ( chrome://flags/#allow-insecure-localhost ) – Dirk – 2018-09-10T21:20:23.340

You can avoid the message for trusted sites by installing the certificate.

This can be done by clicking on the warning icon in the address bar, then click

"Certificate Information" -> Details Tab -> Copy to file

Save the certificate, then double click on the certificate file. On the certificate window that opens, click install certificate, then walk through the install.

The next time you go to the site it should work fine without errors.

chills42

Posted 2009-08-21T15:43:18.083

Reputation: 2 646

It's not working – Harikrishnan – 2014-07-21T05:08:06.930

In order for this to work, the certificate author must match the domain. Otherwise the Chrome does not consider imported certificate as safe. – Dejv – 2015-10-12T13:04:49.033

1its 2016. Hello? Chrome is not listening to us. – YumYumYum – 2016-04-06T12:33:08.823

1chills42 this worked for me , whew! Thanks! – Sajjan Sarkar – 2016-11-04T13:52:43.870

There is no certificate information any more in recent browsers. – user1050755 – 2017-04-21T08:30:36.387

Yeah, it's still available within the security tab in the development console though. – chills42 – 2017-04-21T16:06:04.917

1Hmm.. I've tried what you said on two sites but it doesn't seem to be working. Do you think I have to reboot after I installed the certificate? – sippa – 2009-08-21T16:13:46.137

3I also tried go into Options in Chrome and then Manage Certificates and import them that way. It says imported successfully but it doesn't show up in the list. – sippa – 2009-08-21T16:35:10.943

For Chrome on OSX, here's a relatively easy way to add the self-signed certificate to the system's Keychain, which is used by Chrome: Google Chrome, Mac OS X and Self-Signed SSL Certificates. No more annoying red warning screen! (I do wish Chromium would simplify adding the exception though.)

davemyron

Posted 2009-08-21T15:43:18.083

Reputation: 346

I had to copy the certificate from Safari (12.0.3), since from Chrome (72.0.3626.121) didn't work. – Ricardo – 2019-03-08T02:02:10.740

Thank you. If you receive Error 100013 when adding it through Keychain Access, refer to this page: http://bit.ly/jBujt1

– Chris Serra – 2011-06-20T01:19:55.553

@ChrisSerra - I'm trying to follow your bitly link but get a 404; can you elaborate on what the instructions there were? – EmmyS – 2011-11-01T16:08:14.083

@EmmyS: I'm sorry -- I really do not remember. Was trying to find the page in Google Cache, but was not successful. I'll try to review the process again, and see if muscle memory helps me recall the solution. – Chris Serra – 2011-11-02T20:01:59.480

@ChrisSerra - no big deal; we did figure out how to do it. – EmmyS – 2011-11-02T20:24:26.653

Thanks for the link. It worked. It seems that the certificate's CN must still match the url's domain even after these steps. Also Step 5 on that site is not needed. It can be added to your login keychain and doesn't need to be in the system keychain. – mhost – 2012-11-08T08:08:03.977

Instructions for Linux (Chrome 12+):

Certificate Information -> Details -> Export

Save the certificate as a file of your choice.

Preferences -> Under the hood -> Manage certificates -> Authorities

Import the file and check all the boxes when it asks. You are done.

It is very important to import under the Authorities tab, and not other!

lzap

Posted 2009-08-21T15:43:18.083

Reputation: 782

Finally a answer that works! Thank you very much! – Andre Figueiredo – 2017-06-05T20:26:05.013

5The file contained one certificate, which was not imported: xxx.xxxxx.com: Not a Certification Authority. – kachar – 2013-06-03T12:52:44.383

Well it looks like you dont have authority cert. Try different tab. The question is for authorities... – lzap – 2013-06-03T13:36:13.237

1Yep, it worked on tab 'Other certificates' – kachar – 2013-06-04T20:37:28.053

On OsX you should export your certificate from firefox and import on keychain under the login profile.

Fernando Meyer

Posted 2009-08-21T15:43:18.083

Reputation: 31

In order for me to get this to work, I had to copy to file using the "Cryptographic Message Syntax Standard - PKCS #7 Certificates (.P7B)" option and check the "Include all certificates in the certification path if possible" box.

Then I imported using Cornelius' instructions and it worked.

caspian

Posted 2009-08-21T15:43:18.083

Reputation: 11

1This still gets me "NET::ERR_CERT_COMMON_NAME_INVALID".. – Amalgovinus – 2015-08-06T00:20:04.313

If the site to which you go, your own server, make sure that you have installed the Self-Signed certificate or a certificate from a Trusted Authorities on your server. Some server software sets the default test certificate, which can not be added to the Trusted root Authorities certificate store.

Nikolai Vakulenko

Posted 2009-08-21T15:43:18.083

Reputation: 61

If the Google paternalism becomes insufferable as in:

we don't want users to visit a site with a revoked certificate. If you think this bug report is about #2, I'll mark it WontFix. Would you like me to do that?

you can nullify the browser's TLS system completely by using a TLS proxy that signs all TLS connection opening with its own TLS root CA. Obviously, that has annoying consequences like the inability to view the real certificate of a website with the Chrome interface. Also, client TLS certificates are by design not compatible with that TLS proxying.

Many Google Chrome extensions allow you to select proxies based on domain, so you could only proxy those domains that are known to cause TLS issues in Chrome.

curiousguy

Posted 2009-08-21T15:43:18.083

Reputation: 345