HSTS Browser Origin: On your device Last updated 15 Oct 2026

Chrome: You cannot visit example.com right now because the website uses HSTS (NET::ERR_CERT_… no bypass)

The site told browsers to use only valid HTTPS (HSTS), so Chrome hides the "Proceed anyway" link when its certificate has any problem.

Exact message you may see because the website uses HSTSYou cannot visit right now because the website uses HSTSHSTS no bypass
Explore the map of this error Full error map →
Seen on: Chrome Edge Firefox

Meaning

HSTS (Strict-Transport-Security) is a security feature. When the certificate is expired, self-signed, or the clock is wrong, there is no bypass button. Fix the certificate, correct the device date, or (for a local development domain you control) clear the HSTS entry for that host.

Common causes

  • Expired, self-signed or mismatched certificate on an HSTS site
  • Wrong system date/time on the device
  • Intercepting proxy/antivirus with an untrusted CA
  • Local dev domain previously served with HSTS
  • Preloaded HSTS domain (.dev, .app)

⚡ Quick fix

  1. Owners: renew/fix the certificate chain
  2. Visitors: check date and time, update the browser and disable HTTPS-scanning
  3. Developers: remove the entry at chrome://net-internals/#hsts (Delete domain security policies)

Detailed fix by platform

Chrome

  1. Open chrome://net-internals/#hsts, type the domain under "Delete domain security policies" and press Delete (works for non-preloaded hosts)

Linux

  1. Verify the certificate and header: curl -sI https://example.com | grep -i strict-transport

How to diagnose

  1. Certificate — What exact certificate error is shown under Advanced?
  2. Clock — Is the date/time correct?
  3. Header — Does the site send Strict-Transport-Security?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: On your device. Errors that are often confused with or caused by this one (click to open):

captive portal — Browser: This network requires you to sign in — captive portal (hotel, airport, café Wi-Fi) blocking HTTPS sites (Browser)captive portalERR_CERT_AUTHORITY_INVALID — NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private) (JavaScript)ERR_CERT_AUTHORITY_IN…ERR_CERT_DATE_INVALID — NET::ERR_CERT_DATE_INVALID (certificate expired) (JavaScript)ERR_CERT_DATE_INVALIDERR_CONNECTION_CLOSED — Chrome: This site can’t be reached — example.com unexpectedly closed the connection. ERR_CONNECTION_CLOSED (Browser)ERR_CONNECTION_CLOSEDERR_SSL_OBSOLETE_VERSION — Chrome: Connection not secure — ERR_SSL_OBSOLETE_VERSION (old TLS 1.0/1.1) (Browser)ERR_SSL_OBSOLETE_VERS…ERR_SSL_VERSION_OR_CIPHER_MISMATCH — Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Browser)ERR_SSL_VERSION_OR_CI…NET::ERR_CERT_REVOKED — Chrome: Your connection is not private — NET::ERR_CERT_REVOKED (the certificate was revoked) (Browser)NET::ERR_CERT_REVOKEDPermissions policy violation — Console: [Violation] Permissions policy violation: camera is not allowed in this document (Feature-Policy) (Browser)Permissions policy vi…HSTS

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.