42 ms·

I'm not an end user, and I should have the ability to bypass expired/invalid cert errors on both my own sites, as well any other site out of curiosity. Sure, lo

I'm not an end user, and I should have the ability to bypass expired/invalid cert errors on both my own sites, as well any other site out of curiosity. Sure, lock it behind a flag or other hidden setting, that even covers enterprise clients because they already disable setting those on their domain computers, but it should be possible nonetheless to bypass the error.

sjwright 8y ago
That's an objection to the exposed features in your web browser, not the normal use of HSTS by websites. Did you even try a Google Search?[0] If you use Firefox (which you should) it is possible to bypass that setting, using a feature locked behind "a flag or other hidden setting." Specifically, it is the about:config setting security.mixed_content.use_hstsc My suggestion is to use Firefox Developer Edition and modify the security setting there—allowing you to bypass HSTS whenever you like without any accidental security risk for your normal browsing. [0] https://campus.barracuda.com/product/websecurityagent/doc/73699516/how-to-clear-the-hsts-cache-or-disable-hsts-for-firefox/ https://campus.barracuda.com/product/websecurityagent/doc/73...