This is unsafe

Rogelio Flores Zubillaga
2 min readFeb 3, 2021
Photo by Cindy Tang on Unsplash

Apparently, I’m the last one in the world to discover this hidden functionality in Chrome (the web browser).

Today I was frustrated because I wanted to test my web app on my localhost with SSL on, and the Chrome browser refused to serve the page on the grounds that my “connection is not private”.

Page displayed by Chrome when trying to access SSL page with invalid (self-signed) certificate.

It used to be — maybe years ago — that by hitting the “Advanced” button, you would then see a link that said something like “Proceed to [insert-domain-name-here] (unsafe)”. By clicking on that link, you could then access the page. After all, you’ve been warned, so Chrome assumed that you now knew what you were doing.

Apparently Chrome knows better than you, because that option no longer exists. But wait, there’s even a better option now, for those that happen to know. Because it is nowhere to be found in the chrome://flags or chrome://settings (correct me if I’m wrong).

An obvious solution is to use a browser that doesn’t assume to know better. Firefox works for me, and perhaps Safari (didn’t test).

Being the stubborn fellow that I am, I searched online for a solution because I wanted to keep using Chrome for all my development needs. A proposed solution I knew about and that I read online was to save the self-signed certificate of my application on my (macOS) Keychain Access settings so that Chrome would then accept it as authoritative.

But laziness dictated for a b̵e̵t̵t̵e̵r̵ e̵a̵s̵i̵e̵r̵ faster solution. Who wants to import certificates and save them in the appropriate place? I was looking for a magical setting that would just tell this (ahem, stubborn) browser that I know better. After all, it’s my application.

And oh did I find the magical setting!

I ran into this page which offered three solutions. The first one is about the advanced link I described above that is no longer available in Chrome. The third one is about a Chrome flag that is also no longer available. And the second one . . . is the magical solution:

  1. Click a blank section of the denial page.
  2. Using your keyboard, type thisisunsafe. This will add the website to a safe list, where you should not be prompted again.

My mind was blown. And I’m not the only one judging by the comments on that page. So after typing thisisunsafe I can now continue on my merry way. Chrome 0–1 Me!

--

--

Rogelio Flores Zubillaga

I create web and mobile apps for a living. Play soccer for fun. Wish it were the other way around. I write about software, life, and the universe.