I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My extension will compare the certificate presented from an external different source (XHR) with the one presented by browser and not allow user to proceed further in case of check failure. Recently, chrome has started detecting proxy and gives user-friendly error messages to "proceed anyway" or "back to safety". Once you accept the risk and click "proceed anyway", Chrome won't ask you again for the same website. I want to achieve effect similar to HSTS sites (completely blocking navigation in case of SSL validation error), but with flexibility to manage my own list. I studied the webRequest (https://developer.chrome.com/extensions/webRequest) and DeclarativeWebRequest APIs but was unable to find anything exposing SSL certificate validation process. In nutshell, something similar to Perspectives addon in firefox but with my own way to trust certificates in Chrome. Google has proposed a draft API couple of years back (https://sites.google.com/a/chromium.org/dev/developers/design-documents/extensions/proposed-changes/apis-under-development/webrequest-ssl-hooks), yet to be made available. Any workaround is appreciated. Thanks in advance.
No, and it doesn't seem likely to be added as a feature. See https://code.google.com/p/chromium/issues/detail?id=107793#c20
I'm just deeply concerned about the code complexity cost here, which increases the opportunity for both performance and security bugs. - [email protected]
This may be available in Chrome Development Tools Network.SecurityDetails. which provides security details about the request.