How to Clear HSTS Settings in Chrome and Firefox

Free vector hand drawn flat design ssl illustration. Freepik / @freepik

HSTS, or HTTP Strict Transport Security, is like the unwavering guardian of web security. It's the digital bouncer that ensures web browsers can only enter the exclusive club of secure HTTPS connections, never venturing into the sketchy territory of HTTP. Why is this such a big deal? Well, it's all about thwarting the bad guys – the ones who'd love to play tricks like protocol downgrade attacks and cookie hijacking.

Picture this: back in 2009, a cybersecurity whiz named Moxie Marlinspike dropped some knowledge at the BlackHat Federal event. He unveiled a nasty vulnerability in SSL, the technology responsible for secure web connections. This vulnerability was the very chink in the armor that HSTS was forged to protect against, a vulnerability that Marlinspike's SSLStrip tool demonstrated all too well.

Now, SSLStrip, that's a sneaky one. It has this knack for turning secure HTTPS connections into flimsy HTTP ones, putting your data at risk. But HSTS doesn't flinch. It sends a clear message to your browser – HTTPS, and nothing else, period. This straightforward instruction is like a security forcefield that keeps SSLStrip and its shady friends at bay. Your secure connections stay, well, secure.

And that's not all – HSTS is also the guardian of your precious login credentials. Imagine you're logging in with your favorite online service, and lurking in the shadows is a tool like Firesheep, ready to snatch your credentials. HSTS says, "Not on my watch!" By insisting on HTTPS, it makes sure your login details remain safely out of reach for would-be attackers.

But here's the catch – some HSTS settings can be a little too strict for their own good. If you're using Chrome and suddenly see a message that goes, "Privacy error: Your connection is not private" (NET::ERR_CERT_AUTHORITY_INVALID), don't panic. It might just be HSTS acting up. Other browsers may not give you grief, which points to a local HSTS issue.

Privacy error: Your connection is not private" (NET::ERR_CERT_AUTHORITY_INVALID)

So, what's the solution? You'll need to give your HSTS settings a little spring cleaning. Here's how to do it on Google Chrome and Mozilla Firefox. Think of it as tidying up your digital security wardrobe – keeping the essentials and tossing out the outdated clutter. Your online security deserves nothing less.

Clear and Forget HSTS Settings In Your Favorite Browsers

Have you ever hit a virtual roadblock with your browser? Picture this: you're trying to connect to a website, and suddenly, an error slams the brakes on your browsing adventure. This error, unlike others, refuses to be ignored. It's the handiwork of HSTS, or HTTP Strict Transport Security, and it's here to stay until you fix it.

HSTS is like a digital bodyguard, ensuring that your browser sticks to secure HTTPS connections and doesn't wander into the shady world of HTTP. But sometimes, things go awry. Maybe you're trying to connect over HTTP, or there's a hiccup in your HTTPS connection – like a mismatched hostname or an expired certificate. That's when HSTS swoops in, and it's a no-nonsense gatekeeper. It's been told, "Only secure connections allowed."

Now, HSTS comes with a nifty feature called "max-age." This is its internal clock, ticking away, deciding how long it will remember these strict rules before giving them another look. If you want to move past that error pronto, you've got to roll up your sleeves and clear your browser's HSTS settings for that specific domain. We've got the how-to for you down below.

But here's the catch – you need to do this dance in every browser you use. If you're a tech-savvy developer, you might bump into this error while testing an HSTS setup. Even on your local testing ground, Chrome might throw you a curveball with this error. And if you've deployed HSTS on a live site, fixing user errors could be a real head-scratcher, depending on your audience size. Each user has to pitch in and delete their local HSTS settings or simply wait for them to fade away, as dictated by the 'max-age' you've set.

One more thing to keep in mind – if the website keeps serving that HSTS header, your browser will snap it up again the moment you return to the site. So, if you're done with this error's encore performances, you've got to stop the website from sending that header in the first place.

Chrome and Firefox, the dynamic duo of browsers, don't have a secret code for HSTS errors, but they drop hints on those interstitial error pages. In Chrome, you might spot "NET::ERR_CERT_COMMON_NAME_INVALID." If you dig deeper by clicking "Advanced," you'll see, "You cannot visit domain.com right now because the website uses HSTS." Bingo, it's an HSTS showdown. On localhost, Chrome might shrug and say, "This site can't provide a secure connection."

Over in the Firefox corner, the interstitial page will say, "This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate."

If you've cracked the code and realized it's those cached HSTS settings causing the havoc, follow these instructions to restore order in your browser universe. It's time to bid those HSTS errors farewell!

Deleting HSTS Settings in Chrome

Alright, let's demystify the process of clearing out those stubborn HSTS settings in Chrome. It's like tidying up your digital closet, ensuring your browser doesn't lock you out of certain websites with its strict security rules.

1. First off, open up your Chrome browser and type in this magical URL: chrome://net-internals/#hsts. You'll find yourself in Chrome's inner sanctum for managing your browser's HSTS settings.
2. Now, to make sure Chrome has those HSTS settings on record for the domain you're targeting, scroll down to the bottom of the page. There, you'll spot the Query Domain section. Type in the domain's hostname and hit "Query." If it tells you, "Found with settings information below," you've got confirmation that the domain's HSTS settings are tucked away in your browser.
3. The moment of truth! Take that same hostname you just queried and move on to the Delete domain section. Paste it in there and give it a little click. Voila! Your browser is no longer going to be so insistent about forcing that HTTPS connection for that particular site.
4. Now, here's where it gets exciting. You can put your digital cleaning skills to the test. Refresh the page or navigate back to the site to see if everything is working like a charm.

Just a quick heads-up: depending on the HSTS settings served up by the site, you might need to get specific with the subdomain. For example, if the site's HSTS settings are different for staging.yoursite.com compared to yoursite.com, you may need to repeat these steps for each as needed.

So, there you have it – a simple guide to liberate your browser from those clingy HSTS settings in Chrome. It's all about taking back control, one domain at a time!

Deleting HSTS Settings in Firefox

We've got a straightforward approach that should work like a charm for most cases, but just in case, we've got a manual option up our sleeves too.

Method 1: The Quick and Easy Way

1. Start by giving your Firefox browser a breather. Close all those tabs you've been juggling.
2. Now, let's summon the full History window with a magical keyboard shortcut: Ctrl + Shift + H (or Cmd + Shift + H if you're on a Mac). Make sure you use this window or the sidebar for our next steps to work their magic.
3. Hunt down the site that's been giving you HSTS trouble. If you're in a hurry, there's a handy search bar at the upper right to help you find it.
4. Here comes the fun part – right-click on that misbehaving site from the list of items and choose "Forget About This Site." This nifty move not only clears out the HSTS settings but also sweeps away other pesky cache data for that domain.
5. Now, give your Firefox a quick reboot. Once it's back in action, visit the site you've been wrestling with. You should now have the freedom to connect over HTTP or mend those broken HTTPS connections. It's like breaking free from digital handcuffs!

Method 2: The Manual Approach (for the Persistent Cases)

If our first method didn't quite do the trick, don't worry; we've got a more hands-on solution:

1. Start by following steps 1 and 2 from Method 1 to access the History window.
2. Now, if you're still facing HSTS woes, it's time for the manual maneuver. We won't let those settings hold us back.

While these methods should do the trick in most situations, it's essential to keep in mind that web technologies can be finicky, and individual cases may vary. However, armed with these methods, you'll be well-prepared to tackle HSTS settings in Firefox, whether you choose the quick route or the manual one. It's all about regaining control over your browsing experience, one site at a time!

When all else fails, and those pesky HSTS settings just won't budge in Firefox, don't fret. We've got one more ace up our sleeve. Let's delve into the nitty-gritty of this manual method.

Method 3: The Hands-On Approach

1. Start your journey by pinpointing your Firefox profile folder. You can access this folder by taking a little detour through Firefox itself. Simply type "about:support" into your address bar, and hit enter.
2. Scroll down the page until you reach the Application Basics section. Right there, like a hidden treasure, you'll find "Profile Folder." Give it a gentle click, and it will open up a window to your profile folder.
3. Now, here's where the magic happens. Close Firefox, so it doesn't go meddling with the settings we're about to tweak.
4. In your Profile folder, you'll stumble upon a file called "SiteSecurityServiceState.txt." This file is where all the cached HSTS and HPKP (Key Pinning) settings for domains you've visited are stored. Warning: It might look like a digital jungle in there!
5. Time to roll up your sleeves. Use the search function to hunt for the domain you're itching to clear the HSTS settings for. Once you've located it, it's eviction time. Delete the entire entry for that domain, starting from the domain name itself and going all the way to the next listed domain. You're creating a clean slate, just like giving your browser's memory a fresh start.

Alternatively, if you're feeling cautious and want to preserve the existing file, you can rename it from ".txt" to ".bak." This way, you keep a backup just in case things take an unexpected turn. Firefox will create a brand new file the next time it starts up, and hopefully, you'll have bid those HSTS settings farewell.

In the world of web browsers, sometimes you need to get your hands dirty to tame those unruly settings. With this manual method, you've got the power to regain control over your Firefox browser and make those HSTS settings work for you, not against you. It's like cleaning out your digital attic, making room for smoother browsing experiences.