Would you tell us reproducible steps please?
Loading www.fiverr.com didn't produce net::ERR_INSECURE_RESPONSE error.

hi,

Please see how fiverr looks when i open in chrome (screen 1 & 2) but in
monzilla firefox (Screen3) it opens fine

Could you attach a net-internals log per these instructions? Thanks!
https://dev.chromium.org/for-testers/providing-network-details

By the way, your screenshots don't seem to be showing up. I think you need to make your comment from the web age at: https://bugs.chromium.org/p/chromium/issues/detail?id=660646

> [...] from the web age at:

(That was meant to say "web page".)

Given that this error code is seemingly only surfaced by service workers, adding a tag for the SW team.

thanks

askphomoz: Please see comment #4. https://www.fiverr.com/ doesn't show the error for me.

Thank you for providing more feedback. Adding requester "tkent@chromium.org" for another review and adding "Needs-Review" label for tracking.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

askphomoz: Could you respond to c#4 please?  Thanks in advance ...

I can confirm that, I guess since last update (I'm now using 53.0.2785.143), I have multiple web sites not working because of ERR_INSECURE_RESPONSE (observe in Network tab in Dev Tools): for example, for me Atlassian JIRA doesn't open properly. Some sites are reported as insecure as with certificate issues usually. Clearing cache and disabling AD block etc. doesn't help (tried to start with `chromium-browser --disable-extensions --disable-plugins`). Same sites open fine in other browsers on same machine.

Strangely enough, www.fiverr.com works fine for me. 

Please feel free to email the INSECURE_RESPONSE log to me if you are not comfortable posting here.

Finally, I've been able to reproduce this issue and capture the net-internals log correctly. I'm attaching it here. In this case I was working on a web app of my own and the web page failed to load bootstrap.min.css from the bootsrap's CDN. Same issue observed in Network tab - bootstrap.min.css marked with `(failed)` status and error is `ERR_INSECURE_RESPONSE`. Same resource loads well in other browsers.

Deleted: net-internals-log.json 110 KB

net-internals-log.json 110 KB View Download

Hey, Josh, you willing to comment on this?  Looking at the bug the ERR_INSECURE_RESPONSE is coming from the URLRequest delegate, I presume this is the URLRequest the WriteToCacheJob is creating to fetch stuff for it, and I think you had something to do with that file?

Looking at the code it looks like it's either a certificate error or we're bouncing the file because it's not JS (though I don't understand that logic) or we're bouncing it because it doesn't satisfy path restrictions.  But I don't understand the code well enough to be sure what's going on.

WDYT?

ServiceWorkerWriteToCacheJob is used to fetch and store a service worker JS file during service worker registration or update. So WriteToCacheJob would only be involved if the site is trying to register bootstrap.min.css as a service worker which is strange. Furthermore since https://maxcdn.bootstrapcdn.com is on a different origin, the request wouldn't get this far unless a page on https://maxcdn.bootstrapcdn.com itself is trying to register the worker.

Could the net::ERR_INSECURE_RESPONSE error come from SSLErrorHandler::DenyRequest?
https://cs.chromium.org/chromium/src/content/browser/ssl/ssl_error_handler.cc?sq=package:chromium&dr=C&rcl=1481502937&l=71

same issue here with chromium Version 53.0.2785.143 built on Debian stretch/sid, running on Debian stretch/sid (64-bit).
Jira, Bitbucket Codeship, are broken.

Deleted: screen-2016-12-13-1481634058.png 239 KB

	screen-2016-12-13-1481634058.png 239 KB View Download

net internals log for previous comment

Deleted: net-internals-log.json 629 KB

net-internals-log.json 629 KB View Download

Bumping to P1; this seems serious.

comment 20's netlog has more clues:
t=5789 [st=101]     -SSL_CONNECT
                     --> net_error = -214 (ERR_CERTIFICATE_TRANSPARENCY_REQUIRED)

It's curious that the two netlogs and reports are for Chrome 53 on Linux. Chrome 53 was the stable release in September and if there was a regression there we should have heard by now. It looks like something particular to Chrome 53 for Ubuntu and Debian.

netlog from comment #15: Chromium 53.0.2785.143 (unofficial 12ae4ebf489873fc4aad9efc231b9151b330a938) Built on Ubuntu , running on Ubuntu 16.04

netlog from comment #19: Chromium 53.0.2785.143 (unofficial 12ae4ebf489873fc4aad9efc231b9151b330a938) built on Debian stretch/sid, running on Debian stretch/sid

I suspect this is the same as  issue 664177 , though I don't understand the circumstances where ERR_INSECURE_RESPONSE would be emitted rather than ERR_CERTIFICATE_TRANSPARENCY_REQUIRED.

Just noticed that netlog #1 also has ERR_CERTIFICATE_TRANSPARENCY_REQUIRED errors. Can reporters please upgrade to Chromium 55 as recommended in  issue 664177  and see if that fixes the issue?

Merging into 664177

To answer falken@'s question in Comment #23 - ERR_INSECURE_RESPONSE is what's surfaced by SWs when there's an SSL error. That is, it swallows the more specific error and maps it to the generic error (we also do this when a user denies bypassing an SSL error)

https://cs.chromium.org/chromium/src/content/browser/service_worker/service_worker_write_to_cache_job.cc?rcl=0&l=293 is the relevant section