google-chrome - SSL Localhost 隐私错误

Question

我在本地主机 (wamp) 上设置了 ssl，我用 GnuWIn32 制作了 ssl crt。

当我尝试在 Chrome 中使用 fb 登录时，我收到以下消息:

网址:

https://localhost/ServerSide/fb-callback.php?code=.....#_=_

错误:

Your connection is not private.
Attackers might be trying to steal your information from localhost (for example, passwords, messages, or credit cards). NET::ERR_CERT_INVALID. localhost normally uses encryption to protect your information. When Chrome tried to connect to localhost this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be localhost, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Chrome stopped the connection before any data was exchanged.

You cannot visit localhost right now because the website sent scrambled credentials that Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later.

我的 SSL 配置:

Listen 443    
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5    
SSLPassPhraseDialog  builtin    
SSLSessionCache        "shmcb:c:/wamp/www/ssl/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300    
<VirtualHost *:443>    
DocumentRoot "c:/wamp/www"
ServerName localhost:443
ServerAdmin admin@example.com
ErrorLog "c:/wamp/logs/error.log"
TransferLog "c:/wamp/logs/access.log"
SSLEngine on
SSLCertificateFile "c:/wamp/www/ssl/ia.crt"
SSLCertificateKeyFile "c:/wamp/www/ssl/ia.key"
<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>
<Directory "c:/Apache24/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>    
BrowserMatch "MSIE [2-5]"  nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog "c:/wamp/logs/ssl_request.log" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>   

我的问题是如何在本地主机上设置有效的 SSL 证书？还是我需要编辑我的配置？

Answer 1

允许不安全的 SSL(本地主机)

在 Chrome(包括 版本 113)中，启用允许不安全的本地主机:

chrome://flags/#allow-insecure-localhost

引用this Stack Overflow获取更多信息。

---

允许不安全的 SSL(其他)

1. 查看“您的连接不是私有(private)的。blah-bla-blah”...
2. 键入 thisisunsafe (关键听众将其拾起)。

---

注意事项

如果您只是好奇这是否有效，请浏览 this site它有一个坏的根 ssl 证书。可以使用 badssl.com 找到其他“坏 ssl”站点.

More关于chromium "override keyword" :.

This is specific for each site.

The chrome developers also do change this periodically.

The current (v113) BYPASS_SEQUENCE is dGhpc2lzdW5zYWZl (which is base64 encoded).