Issue metadata
Sign in to add a comment
|
Valid HTTPS required for *.dev due to HSTS preload
Reported by
n.vander...@mycademy.com,
Sep 18 2017
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3218.4 Safari/537.36 Steps to reproduce the problem: 1. make a self signed ssl certificate 2. add it to a locally hosted site 3. navigate to the site What is the expected behavior? Same error as now, but with a button to proceed to site anyways What went wrong? No button to proceed anyways, which now causes the problem that you cant develop locally using self signed ssl certificates to test SSL. Did this work before? Yes 60.0.3112.113 Does this work in other browsers? Yes Chrome version: 63.0.3218.2 Channel: canary OS Version: 10.0 Flash Version: - This is a huge deal. If these patched make it to the regular build, developing locally using chrome will not be possible with SSL, and might cause majoy issues when implementing SSL...
,
Sep 19 2017
I don't have any sites with invalid/self-signed SSL certificates at the moment that are publically accessible. You can reproduce this issue quite easily on your local machine by generating a self-signed SSL certificate and use it in apache/nginx though. That's how I encountered the problem. Kind Regards, *Nick van der Meij * Webdeveloper MyCademy.com *-------------------------------------------------------* n.vandermeij@mycademy.com +31 (0)262051333 <+31%2026%20205%201333> 2017-09-19 12:47 GMT+02:00 a… via monorail < monorail+v2.463707639@chromium.org>:
,
Sep 19 2017
Thank you for providing more feedback. Adding requester "ajha@chromium.org" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 19 2017
n.vandermeij: Do you see the proceed link when you go to https://self-signed.badssl.com/
,
Sep 19 2017
+lgarron The button is missing because all of .dev is HSTS. The issue is that .dev is a real TLD. It shouldn't be used for local testing. In particular, the operators for .dev decided to set HSTS on the whole TLD for security. Per RFC 2606, you should one of the TLDs reserved like .test for localy testing. So kms.test rather than kms.dev. Those names won't collide with real sites.
,
Sep 19 2017
Indeed, this is desired behaviour of preloading .dev for HSTS.
As davidben@ describes, you should be using one of the TLDs described in RFC 2606 to avoid collisions with possible future domains:
.test
.example
.invalid
.localhost
I'm marking this bug as WontFix because this behaviour is intended, but people are welcome to comment here if they have situations that are not a case of "we assumed we could use .dev like .test".
,
Sep 20 2017
Interesting, I didn't know that it was actually a TLD. Sorry for the inconvenience, we will change our test domains to .test as soon as possible. Thanks for the helpful insight! Kind Regards, *Nick van der Meij * Webdeveloper MyCademy.com *-------------------------------------------------------* n.vandermeij@mycademy.com +31 (0)262051333 <+31%2026%20205%201333> 2017-09-19 21:21 GMT+02:00 david… via monorail < monorail+v2.294852074@chromium.org>:
,
Sep 21 2017
Issue 767167 has been merged into this issue.
,
Oct 5 2017
Issue 772033 has been merged into this issue.
,
Oct 25 2017
Issue 778198 has been merged into this issue.
,
Dec 12 2017
Issue 793770 has been merged into this issue.
,
Dec 12 2017
Issue 794160 has been merged into this issue.
,
Dec 18 2017
Issue 793994 has been merged into this issue.
,
Dec 18 2017
Issue 795678 has been merged into this issue.
,
Dec 18 2017
Issue 795748 has been merged into this issue.
,
Dec 18 2017
Yes, in Chrome 63 it is working as intended that all *.dev and *.app sites redirect to HTTPS. https://textslashplain.com/2017/12/05/strict-transport-security-for-dev/
,
Dec 18 2017
Issue 795654 has been merged into this issue.
,
Jan 4 2018
Issue 799039 has been merged into this issue.
,
Apr 26 2018
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ajha@chromium.org
, Sep 19 2017Components: Internals>Network>Certificate Internals>Network>SSL
Labels: Needs-Triage-M63 Needs-Feedback