No “Proceed Anyway” option on NET::ERR_CERT_INVALID in Chrome on MacOS

Question

FYI: Chrome on MacOS treats this different than Windows. MacOS version won't see the proceed button even you click advanced button.

To still proceed the visit as you are sure this page is safe, here is a easy way to do:

There's a secret passphrase built into the error page. Just make sure the page is selected (click anywhere on the screen), and just type thisisunsafe.

Ref: https://twitter.com/zairwolf/status/1196878125734486021

There is a hidden way to bypass that error, even if no button allows it. Of course, this should be used for your own sites only – where you are perfectly sure that site is not hacked, but simply local and therefore without a valid internet certificate.

Simply click anywhere on the denial page and type “thisisunsafe”.

Sounds crazy, but works to bypass chrome’s supervision of your safety. Chrome should get kicked for not accepting the certificate of devices in my local network. This is not IoT, this is "Ny Net"!

This solution worked for me.

• Right click, select inspect element
• click on console tab
• Copy paste sendCommand(SecurityInterstitialCommandId.CMD_PROCEED) press Enter

Boom! it should load the page :)

To make even macOS Chrome show the "Proceed" link under advanced, make sure to create the certificate with the TLS Web Server Authentication in the X509 extensions.

Here's a oneliner to create with that extension:

openssl req \
  -newkey rsa:2048 \
  -x509 \
  -new \
  -nodes \
  -keyout server.key \
  -out server.crt  \
  -subj /CN=test1   \
  -sha256  \
  -days 3650  \
  -addext "subjectAltName = DNS:foo.co.uk,IP:127.0.0.1,IP:192.168.1.1" \
  -addext "extendedKeyUsage = serverAuth"

If you MacOS openssl does not have addext option, then use this alternate form:

openssl req \
  -newkey rsa:2048 \
  -x509 \
  -nodes \
  -keyout server.key \
  -new \
  -out server.crt \
  -subj /CN=test1 \
  -extensions v3_new \
  -config <(cat /System/Library/OpenSSL/openssl.cnf \
  <(printf '[v3_new]\nsubjectAltName=DNS:a.spectrocloud.com\nextendedKeyUsage=serverAuth')) \
  -sha256 \
  -days 3650

The key being extendedKeyUsage=serverAuth.