83

I have a HAProxy / stunnel server that handles SSL for our sites on AWS. During testing, I created a self-signed cert on this server and hit it from my desktop using Chrome to test that stunnel was working correctly.

Now I have installed the legitimate cert on that server. When I hit the site from my machine in Chrome it throws the following error:

Error 113 (net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH): Unknown error.

My guess is that Chrome cached the key for the self-signed cert and it doesn’t match that of the legitimate cert. This site works in all other browsers on my machine so it’s just a Chrome problem.

One interesting note: When hitting the page from a incognito session (Ctrl+Shift+N), it works correctly. So it is clearly some sort of cache thing.

I did all the things I could think of (dumped my cache, deleted certs from the Personal and Other People page in the Manage Certificates dialog, Ctrl+F5, etc.).

My machine is Windows 7 x64. Chrome version: 12.0.742.91.

On the Google Chrome Help Form, there is a description of what sounds like the same issue; however, no resolution is found.


UPDATE: It seems to have “fixed itself” today. I hate problems like this. I still don’t know what caused it or how it resolved itself. Presumably the cached cert expired or something, but I am still interested to know where this information is stored and how to verify it.

  • 1
    From another user I heard: This issue was caused on my machine by a slightly outdated Avast Antivirus. Avast creates a layer between your browser and the web with an SHA1 certificate. If you disable avast for a moment, Chrome will be able to access the certificate delivered by your server. In my case, a simple Avast Program Update solved the issue. – Foovanadil Apr 21 '15 at 20:18
  • This was not the case on my machine as I didn't have anti virus installed. – Foovanadil Apr 21 '15 at 20:20
  • 1
    Since the question is locked I can't add an answer, but in windows you have to 1) Go to Settings => Manage Certificates => delete the cert then 2) Close Chrome and then 3) Go to task manager and manually kill all of the Chrome.exe processes. Once you open Chrome again you should be good to go. – jakejgordon Jun 10 '15 at 14:20
  • @jakejgordon -- I wasn't able to see the cert in the Manage Certificates window, but killing Chrome.exe and reopening Chrome did the trick for me. Note, I have a web filter/monitoring proxy running as well, but did not need to stop it. – Lars Kemmann Aug 25 '15 at 2:11
  • 4
    Why is this question "protected" when there are no valid or working answers? @Michael-Hampon? – NickG Jul 6 '17 at 15:05
30

Chrome stores SSL certificate state per host in browser history.

So just clear browser history (Ctrl+Shift+Del), at least the following parts:

  • Cached images and files
  • Hosted app data
  • Content licenses
  • Cookies and other site data, for Chrome version 64

Solution 2. If the above doesn't help, try this:

  • Close Chrome, kill all chrome background processes
  • Delete the directory:
    %USERPROFILE%/AppData/Local/Google/Chrome/User Data/CertificateTransparency
| improve this answer | |
  • My problem is ancient now so chrome may have have change this behavior but it didn't work for me to clear the cache (as I noted in the question). If it works now that would be great. – Foovanadil May 5 '15 at 22:50
  • 46
    This did NOT work for me – Serj Sagan Aug 11 '15 at 9:38
  • 1
    This worked for me, my specific problem was that Chrome was saying that the certificate had expired, but since others could access the site on https, I could see that there was indeed a new certificate available, but for some reason Chrome wasn't requesting it, or possibly reading it properly. – shaheenery Oct 5 '15 at 21:18
  • 1
    FIDDLER users: If you are using Fiddler with HTTPS intercepts, fiddler will cache SSL certificates. To fix this, you need to run fiddlers "Remove Interception Certificates" option, clear your browser's cache (no need to clear anything else, and restart the browser. Depending on which browser you're using, the last two steps might not be needed, but these are needed for Chrome – NickG Jul 6 '17 at 15:14
  • 3
    Sad that I've searched the whole internet and didn't get working solution. But finally tried it out myself. Close Chrome and delete the directory "CertificateTransparency" under "C:/Users/<your-user-name>/AppData/Local/Google/Chrome/User Data" and restart, then you'll find the prompt appear again. – Shou Ya Nov 7 '17 at 16:27
12

Many problems with SSL certificates can be solved by simply removing the file from the cache folder.

In Chrome or Chromium, the file to be removed is cert9.db in the folder ~/.pki/nssdb. (In Firefox, you’d want to remove cert8.db.)

Attention! After removing these files, you will need to re-register CAs in your browser.

This is solution is for linux systems, the steps for Windows users would be somewhat different.

| improve this answer | |
  • 7
    It would be good if you could elaborate or provide links regarding re-registering CAs. – Mike Shultz May 6 '17 at 6:45
  • It seems that quitting and restarting chrome works after this – Ian Turton Oct 16 '17 at 11:06
  • ~/.pki folder doesn't exist for me (on Mac) - and lack of explanation about re-registering CAs seems like a big oversight. Also, "on Windows, somewhat different" is not particularly helpful; if you don't know how to fix it for Windows, just say "this is a *nix-only solution" – dwanderson Jun 27 '18 at 19:04
  • This worked for me, thanks! Ubuntu 18.04 / Linux. – dusoft Feb 3 at 21:38
4

As far as I know, certificates are not specific to Google Chrome (at least on Windows) but to the whole system. You’ve already deleted that cert through Chrome’s interface, so it should gone.

Just to be certain, you could try.

Start → Run → certmgr.msc

Another tool to try is CCleaner. It should help with better cleaning of Chrome’s caches.

| improve this answer | |
  • 1
    Tried certmgr.msc and I don't see the cert in there. Like you said it is clearly gone since the other browsers do the right thing, maybe this is just a chrome bug of some sort – Foovanadil Jun 13 '11 at 18:36
  • So ... did you had any luck so far? Have you tried CCleaner as suggested? .. or any other tool? – LazyOne Jun 14 '11 at 9:00
  • I ran CCCleaner and looked at what it wanted to delete and it was nothing more than what Chrome will delete (Just cookies and session info). – Foovanadil Jun 14 '11 at 16:38
  • 1
    if that is true, why incognitive mode works? – Jose Nobile Feb 6 '17 at 5:38
1

I confirmed this worked for me on Windows 10:

  1. Pre-requisite: Certify (use another computer with no "knowledge" of your site) that your server serves the new certificate to brand new computers, at least.
  2. Clear the cache of Chrome. I chose to clear all three options presented when using CTRL+SHIFT+DEL: History, Cookies, and Cached. However, you can probably keep your history.
  3. Close chrome, and using the Task Manager, certify that there is no chrome.exe running. I think chrome caches the certificate in memory.
  4. Re-open chrome and visit the site. Your chrome browser should now pull the latest certificate and not use the cached one.
| improve this answer | |
  • Wiping entire history seems way too powerful method to remove OCSP-info for a single site. Is there really no alternative? – Jari Turkia Feb 19 at 12:29
  • @JariTurkia, I bet you could actually keep your history. I've updated my answer to suggest this. Your answer could still be helpful for users who want to keep all their cached site data. – Chris Feb 19 at 16:16
0

For Windows 10, there is a way to clear only OCSP and CRL information without clearing Chrome history.

More details can be found from Mr. Dimcev's blog post http://www.carbonwind.net/blog/post/Viewing-clearing-and-disabling-the-OCSP-and-CRL-cache-on-Windows-7.aspx

Running the suggested certutil -urlcache ocsp delete is likely to result in FAILED: 0x80070020 (WIN32: 32 ERROR_SHARING_VIOLATION) if Chrome is running.

| improve this answer | |
-3

More accurate way:

Ctrl+Shift+Del ( or Settings > Advanced > Clear browsing data )

[ Time range: All time ]

  • Chached images and files

press: Clear data

| improve this answer | |
  • 4
    the OP already said he cleared his cache, so for this 7 years old question this answer will not help the op. – Dennis Nolte Sep 24 '18 at 9:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.