HSTS Error: Browser Blocked by HSTS Policy

HSTS Error means the site is on the HSTS preload list but currently has a broken SSL. Chrome won't allow bypassing the warning (security feature). Owner fix: repair the SSL certificate. For testing: chrome://net-internals/#hsts → "Delete domain security policies".

The error can appear in Chrome, Edge, Opera, Brave (all Chromium-based), and partially in Firefox and Safari. Different browsers display the same code differently, but the underlying issue is the same.

1. Check the SSL certificate online — the Enterno.io checker shows the grade, expiry, chain, and specific cause.
2. If the issue is server-side — reissue the certificate via certbot or your chosen CA.
3. Update nginx/apache config (enable TLS 1.2/1.3, fullchain, correct ciphers).
4. Check kernel OpenSSL — an outdated openssl < 1.1 can break handshakes.
5. After deploy: recheck via SSL checker + clear the browser SSL cache.

Check SSL now →

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• Mixed Content
• Check SSL certificate online →

To bypass an HSTS (HTTP Strict Transport Security) error, you can clear your browser's HSTS settings or use a different browser. HSTS enforces secure connections, and if misconfigured, it can lead to access issues. Use the command chrome://net-internals/#hsts in Chrome to manage HSTS settings. For persistent issues, consider reviewing server configurations or temporarily disabling HSTS in your web server settings.

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking. When a website is served over HTTPS, it can include an HSTS header that tells browsers to only connect to it using HTTPS for a specified period.

When HSTS is enabled, browsers store the policy, which can lead to errors if the server configuration changes or if there are issues with the SSL certificate. Common causes of HSTS errors include:

• Misconfigured SSL certificates
• Expired SSL certificates
• Incorrect HSTS header syntax
• Changes in server IP or DNS settings

For example, if a site is configured with the HSTS header Strict-Transport-Security: max-age=31536000; includeSubDomains but the SSL certificate has expired, users will encounter an HSTS error preventing access.

When dealing with HSTS errors, there are several methods to bypass or resolve them. Here are practical steps for different browsers:

For Google Chrome:

1. Open Chrome and navigate to chrome://net-internals/#hsts.
2. In the 'Delete domain security policies' section, enter the domain name that’s causing the error and click 'Delete.' This action removes the stored HSTS policy for that domain.

For Mozilla Firefox:

1. Type about:config in the address bar.
2. Search for security.mixed_content.send_hsts_priming and set it to false.
3. Restart Firefox to apply changes.

For Safari:

1. Go to Safari Preferences.
2. Select the 'Privacy' tab and click on 'Manage Website Data.'
3. Search for the domain and remove its data.

Additionally, if you have control over the server, you can modify the HSTS settings. For example, to temporarily disable HSTS on an Apache server, you can comment out or delete the HSTS header in your configuration file:

# Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

After making changes, restart your web server and clear the browser cache before attempting to access the site again.