Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.

At first I thought it was a quirk on how chrome handles URLs with many dots in a wildcard cert, however I see this text in the warning, and am also unable to click through

You cannot proceed because the website operator has requested heightened security for this domain.


  • Is this a problem with Chrome's wild card certs and sub domains that are more than 2 layers deep?

  • Does the error mean that the website owner has "done something" to make wildcard certificates not work for subdomains?

share|improve this question
up vote 44 down vote accepted

Please try this Chrome hack: when browser shows the page with the invalid certificate message, type in your keyboard the word "proceed" and then hit Enter.

You should be able to proceed to the requested page.

On newer versions of Chrome, you may have to type "danger" and hit Enter instead.

share|improve this answer
aah!! that's wonderful! do you have more info on this? – Karthik Feb 4 '13 at 7:16
Brilliant! I guess they just hid the proceed “button”. At least they didn’t completely remove it and force users to do things their way like the devs are wont to do. – Synetech Mar 4 '13 at 17:50
I'm almost tempted to ask the OP to rephrase the question so we can move this over to superuser. Fantastic tip — many thanks. If only there was a mobile solution! – Barney Sep 24 '13 at 13:49
It's not that fantastic that you can bypass security regularily.. – heinrich5991 Nov 3 '13 at 16:32
This doesn't seem to work anymore, does it? – Kerrek SB May 16 '14 at 16:20

This is a feature called HTTP Strict Transport Security - see and

Sites that send the Strict-Transport-Security header (or are preloaded in Chrome, such as cannot be accessed when the server SSL cert is invalid.

The certificate sent for is valid for *, but since the wildcard only matches a single subdomain, chart.apis is invalid.

If were not included in the STS list, Chrome would also show a button to ignore the error and proceed.


(The correct HTTPS url for Google Chart API is

share|improve this answer

protected by Community Nov 5 '13 at 23:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.