CODEWITHSUNDEEP
apachegoogle-chromesslhttpswamp
ShoeLace1291
ShoeLace1291

Reputation: 4698

How to stop Chrome from redirecting to HTTPS?

A few days ago, Chrome started redirecting all of my vHosts in Wampserver to https. Everything was working fine until a couple days ago, then one day I logged on to work on my site and Chrome said that the site couldn't be reached, even though I used the same URL i always did in the past. Wamp is running as well as Apache and MySQL and none of those services have any errors in the error log.

I have already tried removing the domain(I use a fake .dev extension for my local sites) with chrome://net-internals/#hsts but that didn't do anything. I also tried installing SSL to see if Chrome would detect it as a secure connection... nothing. I even tried reinstalling Wamp completely(even though the vHosts work fine in other browsers) and nothing changed.

The only thing that works in Chrome is accessing the sites via http://localhost/site. The redirect to HTTPS happens for all of my Apache vHosts. I've googled and googled and can't find anything that actually fixes the problem.

Upvotes: 28

Views: 24138

Answers (5)

Liga
Liga

Reputation: 3439

Solution 1 - choose a reserved and future-proof gLTD like .localhost or .test

Edit your hosts file (for Windows it is C:\Windows\System32\Drivers\etc\hosts)

127.0.0.1       testsite.localhost

Solution 2 - install a self-signed certificate for .dev

  1. Create the certificate. Open Powershell as Admnistrator and run:

P.S. Make sure to install mkcert first

C:\Users\John> mkcert *.testsite.dev

This will create a wildcard certificate that will work for all .testsite.dev sites

  1. Copy these keys from C:\Users\John to C:\xampp\apache\crt\testsite_dev (create the crt folder if it doesn't exist)

  2. Add entries in your C:\Windows\System32\Drivers\etc\hosts file

    127.0.0.1       testsite.dev
    127.0.0.1       www.testsite.dev
  1. Open your C:\xampp\apache\conf\extra\httpd-vhosts.conf and add an entry
    <VirtualHost *:443>
       DocumentRoot "C:/xampp/htdocs"
       ServerName testsite.dev
       ServerAlias www.testsite.dev

       Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"

       SSLEngine on
       SSLCertificateFile "crt/testsite_dev/_wildcard.testsite.dev.pem"
       SSLCertificateKeyFile "crt/testsite_dev/_wildcard.testsite.dev-key.pem"
    </VirtualHost>

  1. Restart Apache

  2. (Extra) step - make your OS & browser trust self-signed certificates, otherwise it won't work

Upvotes: 0

gododgers
gododgers

Reputation: 31

I too use the .dev extension and will change to some other domain in the future but for my existing .dev sites, when the privacy error shows up, click anywhere on the screen and type 'badidea' and chrome will redirect you to the site. It works!

Upvotes: 0

benedikt
benedikt

Reputation: 1989

Chrome v63 forces .dev domains to HTTPS. The Internet Engineering Task Force RFC2606 specified what top level domains should be used for local development, and .dev isn't on that list.

Google owns the .dev top level domain and automatically redirects all .dev domain names to an HTTPs version of the site via preloaded HSTS.

With .dev being an official generic top-level domain (gTLD), we're better changing our local development suffix from .dev to something else, even if there are other solutions (e.g. https with self-signed certificates). So you should use .test, .example, .invalid or .localhost as your local development TLDs instead.

Upvotes: 35

Matthew Woodard
Matthew Woodard

Reputation: 754

I have found a quick work-around that worked for my needs and may help someone else.

I use Browser Sync when developing and I just set the proxy argument to "testsite.dev" and it will serve up correctly in Chrome.

Here is the command I am using:

browser-sync start --proxy "testsite.dev" --port "3000" --files "./**/*.*"

Upvotes: 1

DanielV
DanielV

Reputation: 96

I can't improve the answer of @benedikt, as it is correct. There are good temporary fixes:

  • typing "badidea" on the warning page, this might not work if you have SSL set up (hacked together) locally. It bypasses the warning, but my local SSL isn't setup correctly and shows another local site.
  • narayon also suggests a link to a chrome forum, which I haven't tried.

My workaround was to update all my ".dev" development TLDs to ".d3v" Still short enough to type quickly, descriptive, and probably future-proof.

Upvotes: 4

Related Questions