Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.

https://chart.apis.google.com/chart?cht=qr&chs=100x100&chl=otpauth%3A%2F%2Ftotp%2FTest123%204%3Fsecret%3DTKQWCOOJ7KJ4ZIR

At first I thought it was a quirk on how chrome handles URLs with many dots in a wildcard cert, however I see this text in the warning, and am also unable to click through

You cannot proceed because the website operator has requested heightened security for this domain.

Question

  • Is this a problem with Chrome's wild card certs and sub domains that are more than 2 layers deep?

  • Does the error mean that the website owner has "done something" to make wildcard certificates not work for subdomains?

share|improve this question

2 Answers 2

up vote 39 down vote accepted

Please try this Chrome hack: when browser shows the page with the invalid certificate message, type in your keyboard the word "proceed" and then hit Enter.

You should be able to proceed to the requested page.

share|improve this answer
    
aah!! that's wonderful! do you have more info on this? –  Karthik Feb 4 '13 at 7:16
    
Brilliant! I guess they just hid the proceed “button”. At least they didn’t completely remove it and force users to do things their way like the devs are wont to do. –  Synetech Mar 4 '13 at 17:50
    
I'm almost tempted to ask the OP to rephrase the question so we can move this over to superuser. Fantastic tip — many thanks. If only there was a mobile solution! –  Barney Sep 24 '13 at 13:49
    
It's not that fantastic that you can bypass security regularily.. –  heinrich5991 Nov 3 '13 at 16:32
1  
This doesn't seem to work anymore, does it? –  Kerrek SB May 16 at 16:20

This is a feature called HTTP Strict Transport Security - see http://dev.chromium.org/sts and http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security.

Sites that send the Strict-Transport-Security header (or are preloaded in Chrome, such as apis.google.com) cannot be accessed when the server SSL cert is invalid.

The certificate sent for chart.apis.google.com is valid for *.google.com, but since the wildcard only matches a single subdomain, chart.apis is invalid.

If apis.google.com were not included in the STS list, Chrome would also show a button to ignore the error and proceed.

--

(The correct HTTPS url for Google Chart API is https://chart.googleapis.com/chart)

share|improve this answer

protected by Community Nov 5 '13 at 23:33

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.