# Chrome: You cannot visit example.com right now because the website uses HSTS (NET::ERR_CERT_… no bypass)

**Code:** `HSTS` · **Category:** Browser · **Seen on:** Chrome, Edge, Firefox

The site told browsers to use only valid HTTPS (HSTS), so Chrome hides the "Proceed anyway" link when its certificate has any problem.

## Meaning

HSTS (`Strict-Transport-Security`) is a security feature. When the certificate is expired, self-signed, or the clock is wrong, there is no bypass button. Fix the certificate, correct the device date, or (for a local development domain you control) clear the HSTS entry for that host.

## Common causes

- Expired, self-signed or mismatched certificate on an HSTS site
- Wrong system date/time on the device
- Intercepting proxy/antivirus with an untrusted CA
- Local dev domain previously served with HSTS
- Preloaded HSTS domain (.dev, .app)

## Quick fix

1. Owners: renew/fix the certificate chain
2. Visitors: check date and time, update the browser and disable HTTPS-scanning
3. Developers: remove the entry at `chrome://net-internals/#hsts` (Delete domain security policies)

## Detailed fix by platform

### Chrome

1. Open `chrome://net-internals/#hsts`, type the domain under "Delete domain security policies" and press Delete (works for non-preloaded hosts)

### Linux

1. Verify the certificate and header: `curl -sI https://example.com | grep -i strict-transport`

## How to diagnose

1. **Certificate** — What exact certificate error is shown under Advanced?
2. **Clock** — Is the date/time correct?
3. **Header** — Does the site send Strict-Transport-Security?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/browser/hsts-cannot-visit-right-now)