FWIW blocking sites with bogus certs and not allowing a user bypass is exactly what the HSTS RFC requires. If you were testing the HSTS feature of your website,

FWIW blocking sites with bogus certs and not allowing a user bypass is exactly what the HSTS RFC requires. If you were testing the HSTS feature of your website, Chrome is doing the right thing. It's possible to clear Chrome's cache of HSTS-enabled sites btw: https://www.thesslstore.com/blog/clear-hsts-settings-chrome-firefox/ https://www.thesslstore.com/blog/clear-hsts-settings-chrome-...