Getting Chrome to accept self-signed localhost certificate Getting Chrome to accept self-signed localhost certificate google-chrome google-chrome

Getting Chrome to accept self-signed localhost certificate


For localhost only

Simply paste this in your chrome:

chrome://flags/#allow-insecure-localhost

You should see highlighted text saying:Allow invalid certificates for resources loaded from localhost

Click Enable.


This worked for me:

  1. Using Chrome, hit a page on your server via HTTPS and continue past the red warning page (assuming you haven't done this already).
  2. Open up Chrome Settings > Show advanced settings > HTTPS/SSL > Manage Certificates.
  3. Click the Authorities tab and scroll down to find your certificate under the Organization Name that you gave to the certificate.
  4. Select it, click Edit (NOTE: in recent versions of Chrome, the button is now "Advanced" instead of "Edit"), check all the boxes and click OK. You may have to restart Chrome.

You should get the nice green lock on your pages now.

EDIT: I tried this again on a new machine and the certificate did not appear on the Manage Certificates window just by continuing from the red untrusted certificate page. I had to do the following:

  1. On the page with the untrusted certificate (https:// is crossed out in red), click the lock > Certificate Information. NOTE: on newer versions of chrome, you have to open Developer Tools > Security, and select View certificate.
  2. Click the Details tab > Export. Choose PKCS #7, single certificate as the file format.
  3. Then follow my original instructions to get to the Manage Certificates page. Click the Authorities tab > Import and choose the file to which you exported the certificate, and make sure to choose PKCS #7, single certificate as the file type.
  4. If prompted certification store, choose Trusted Root Certificate Authorities
  5. Check all boxes and click OK. Restart Chrome.


With only 5 openssl commands, you can accomplish this.

(Please don't change your browser security settings.)

With the following code, you can (1) become your own CA, (2) then sign your SSL certificate as a CA. (3) Then import the CA certificate (not the SSL certificate, which goes onto your server) into Chrome/Chromium. (Yes, this works even on Linux.)

NB: For Windows, some reports say that openssl must be run with winpty to avoid a crash.

####################### Become a Certificate Authority####################### Generate private keyopenssl genrsa -des3 -out myCA.key 2048# Generate root certificateopenssl req -x509 -new -nodes -key myCA.key -sha256 -days 825 -out myCA.pem####################### Create CA-signed certs######################NAME=mydomain.com # Use your own domain name# Generate a private keyopenssl genrsa -out $NAME.key 2048# Create a certificate-signing requestopenssl req -new -key $NAME.key -out $NAME.csr# Create a config file for the extensions>$NAME.ext cat <<-EOFauthorityKeyIdentifier=keyid,issuerbasicConstraints=CA:FALSEkeyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEnciphermentsubjectAltName = @alt_names[alt_names]DNS.1 = $NAME # Be sure to include the domain name here because Common Name is not so commonly honoured by itselfDNS.2 = bar.$NAME # Optionally, add additional domains (I've added a subdomain here)IP.1 = 192.168.0.13 # Optionally, add an IP address (if the connection which you have planned requires it)EOF# Create the signed certificateopenssl x509 -req -in $NAME.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial \-out $NAME.crt -days 825 -sha256 -extfile $NAME.ext

To recap:

  1. Become a CA
  2. Sign your certificate using your CA cert+key
  3. Import myCA.pem as an "Authority" (not into "Your Certificates") in your Chrome settings (Settings > Manage certificates > Authorities > Import)
  4. Use the $NAME.crt and $NAME.key files in your server

Extra steps (for Mac, at least):

  1. Import the CA cert at "File > Import file", then also find it in the list, right click it, expand "> Trust", and select "Always"
  2. Add extendedKeyUsage=serverAuth,clientAuth below basicConstraints=CA:FALSE, and make sure you set the "CommonName" to the same as $NAME when it's asking for setup

You can check your work to ensure that the certificate is built correctly:

openssl verify -CAfile myCA.pem -verify_hostname bar.mydomain.com mydomain.com.crt