I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain.

https://chart.apis.google.com/chart?cht=qr&chs=100x100&chl=otpauth%3A%2F%2Ftotp%2FTest123%204%3Fsecret%3DTKQWCOOJ7KJ4ZIR

At first I thought it was a quirk on how chrome handles URLs with many dots in a wildcard cert, however I see this text in the warning, and am also unable to click through

You cannot proceed because the website operator has requested heightened security for this domain.

Question

  • Is this a problem with Chrome's wild card certs and sub domains that are more than 2 layers deep?

  • Does the error mean that the website owner has "done something" to make wildcard certificates not work for subdomains?

up vote 44 down vote accepted

Please try this Chrome hack: when browser shows the page with the invalid certificate message, type in your keyboard the word "proceed" and then hit Enter.

You should be able to proceed to the requested page.

On newer versions of Chrome, you may have to type "danger" and hit Enter instead.

  • 1
    aah!! that's wonderful! do you have more info on this? – Karthik Feb 4 '13 at 7:16
  • Brilliant! I guess they just hid the proceed “button”. At least they didn’t completely remove it and force users to do things their way like the devs are wont to do. – Synetech Mar 4 '13 at 17:50
  • I'm almost tempted to ask the OP to rephrase the question so we can move this over to superuser. Fantastic tip — many thanks. If only there was a mobile solution! – Barney Sep 24 '13 at 13:49
  • 5
    This doesn't seem to work anymore, does it? – Kerrek SB May 16 '14 at 16:20
  • 1
    On a recent version of Chrome, "danger" did not work, but "badidea" did. Thanks! – Raman Aug 23 '16 at 13:29

This is a feature called HTTP Strict Transport Security - see http://dev.chromium.org/sts and http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security.

Sites that send the Strict-Transport-Security header (or are preloaded in Chrome, such as apis.google.com) cannot be accessed when the server SSL cert is invalid.

The certificate sent for chart.apis.google.com is valid for *.google.com, but since the wildcard only matches a single subdomain, chart.apis is invalid.

If apis.google.com were not included in the STS list, Chrome would also show a button to ignore the error and proceed.

--

(The correct HTTPS url for Google Chart API is https://chart.googleapis.com/chart)

protected by Community Nov 5 '13 at 23:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.