3 ms·
Somewhat relatedly: a site with HSTS is not supposed to let you click through an invalid cert warning. The browser should also ignore HSTS with invalid (self-si
by tedunangst 3y ago
Somewhat relatedly: a site with HSTS is not supposed to let you click through an invalid cert warning. The browser should also ignore HSTS with invalid (self-signed) certs. But there are bugs, and thus you can find yourself in the position where you're unable to ignore the cert error on a site that never had a valid cert.
- account42 3y ago> Somewhat relatedly: a site with HSTS is not supposed to let you click through an invalid cert warning. A good user agent SHOULD ignore parts of the spec that go against the user's wishes.