Forum Discussion
Ability to save passwords for sites with invalid SSL certs
I just ran across this after upgrading to the newest version of M$ edge, which apparently uses some sort of chromium open source code as its base. now sites with invalid ssl certs, because they were self-signed, are not allowed to remember username or password or save auto-login feature. this is a pain in the **bleep**, as I now have to use a different browser, or obtain valid certificates for everything I manage, which may be internal, and not exactly require a CA-signed cert. this needs to be fixed or more flexible. I even imported the self signed cert into the user and machine certificate stores under trusted CA certificates, and it doesn't change behavior. Major PIA! it would be well-intentioned if I made you recite a secret password before you could use a key in your house door, so your house could verify it was you who had the key, but I don't think you would like me for my well-intentioned security overtures!
MicrosoftEric_Lawrence We are not asking for a workaround. Of coz I know make my cert valid is going to solve this. The problem is there are plenty of reasons why the cert is invalid and they can be perfectly intentional (or I should say not something I consider need to fix), so why block a feature when I know what I am really doing?
- Eric_Lawrencegoodwill1120: As noted immediately above, not everyone recognized that a workaround is available, and some are delighted to have one.
The problem isn't the scenario where you have decided not to fix the security threat; the problem is the scenario where the user is actively under attack and does not recognize the implications of, say, clicking through a certificate error "just to see". You can follow the conversation in https://crbug.com/431618.- And how does refusing to save the password mitigate the risk of that scenario?
Eric_Lawrence thx Eric! I confirmed this works now, per your advice! I had a typo in the name of the cert and reissued it as a self-signed cert (non-CA cert). Next I imported into the local user | Trusted Root Certification Authorities under windows 10. And it works as expected, prompting to save passwords! Many thx, this will save me quite a bit of frustration. I dont think the guys over here know this:
431618 - Google Chrome does not offer to save password for https with unverified ID - chromium
I may make a post over there. but thx again. This is great!
