122

I have a HAProxy / stunnel server that handles SSL for our sites on AWS. During testing, I created a self-signed cert on this server and hit it from my desktop using Chrome to test that stunnel was working correctly.

Now I have installed the legitimate cert on that server. When I hit the site from my machine in Chrome it throws the following error:

Error 113 (net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH): Unknown error.

My guess is that Chrome cached the key for the self-signed cert and it doesn’t match that of the legitimate cert. This site works in all other browsers on my machine so it’s just a Chrome problem.

One interesting note: When hitting the page from a incognito session (Ctrl+Shift+N), it works correctly. So it is clearly some sort of cache thing.

I did all the things I could think of (dumped my cache, deleted certs from the Personal and Other People page in the Manage Certificates dialog, Ctrl+F5, etc.).

My machine is Windows 7 x64. Chrome version: 12.0.742.91.

On the Google Chrome Help Form, there is a description of what sounds like the same issue; however, no resolution is found.

UPDATE: It seems to have “fixed itself” today. I hate problems like this. I still don’t know what caused it or how it resolved itself. Presumably the cached cert expired or something, but I am still interested to know where this information is stored and how to verify it.

Improve this question
10
  • 1
    From another user I heard: This issue was caused on my machine by a slightly outdated Avast Antivirus. Avast creates a layer between your browser and the web with an SHA1 certificate. If you disable avast for a moment, Chrome will be able to access the certificate delivered by your server. In my case, a simple Avast Program Update solved the issue.
    – Foovanadil
    Apr 21, 2015 at 20:18
  • This was not the case on my machine as I didn't have anti virus installed.
    – Foovanadil
    Apr 21, 2015 at 20:20
  • 1
    Since the question is locked I can't add an answer, but in windows you have to 1) Go to Settings => Manage Certificates => delete the cert then 2) Close Chrome and then 3) Go to task manager and manually kill all of the Chrome.exe processes. Once you open Chrome again you should be good to go.
    – jakejgordon
    Jun 10, 2015 at 14:20
  • 5
    Why is this question "protected" when there are no valid or working answers? @Michael-Hampon?
    – NickG
    Jul 6, 2017 at 15:05
  • 2
    I also cannot add an answer but for Chrome it is called HSTS and can be found navigating to chrome://net-internals/#hsts There you can query by domain and delete the cached certificate
    – Edgar Hernandez
    Mar 2, 2018 at 12:02

8 Answers 8

Reset to default
42

Chrome stores SSL certificate state per host in browser history.

So just clear browser history (Ctrl+Shift+Del), at least the following parts:

  • Cached images and files
  • Hosted app data
  • Content licenses
  • Cookies and other site data, for Chrome version 64

Solution 2. If the above doesn't help, try this:

  • Close Chrome, kill all chrome background processes
  • Delete the directory:
    %USERPROFILE%/AppData/Local/Google/Chrome/User Data/CertificateTransparency
Improve this answer
8
  • 60
    This did NOT work for me
    – Serj Sagan
    Aug 11, 2015 at 9:38
  • 2
    This worked for me, my specific problem was that Chrome was saying that the certificate had expired, but since others could access the site on https, I could see that there was indeed a new certificate available, but for some reason Chrome wasn't requesting it, or possibly reading it properly.
    – shaheenery
    Oct 5, 2015 at 21:18
  • 1
    FIDDLER users: If you are using Fiddler with HTTPS intercepts, fiddler will cache SSL certificates. To fix this, you need to run fiddlers "Remove Interception Certificates" option, clear your browser's cache (no need to clear anything else, and restart the browser. Depending on which browser you're using, the last two steps might not be needed, but these are needed for Chrome
    – NickG
    Jul 6, 2017 at 15:14
  • 4
    Sad that I've searched the whole internet and didn't get working solution. But finally tried it out myself. Close Chrome and delete the directory "CertificateTransparency" under "C:/Users/<your-user-name>/AppData/Local/Google/Chrome/User Data" and restart, then you'll find the prompt appear again.
    – shouya
    Nov 7, 2017 at 16:27
  • 1
    @ShouYa I have searched for hours and this solves the problem!
    – wdetac
    Jun 15, 2018 at 10:02
27

In Windows:

Internet Options/Properties > Content > Clear SSL state

enter image description here

Then type in any address bar: chrome://restart

You don't need to clear your entire history.

Improve this answer
7
  • 8
    This needs more upvotes as is the only proper answer. Restarting chrome via chrome://restart also preserves tabs. Amazing! (And 10 years late). Confirmed on Win 11 / Chrome 105
    – GCon
    Sep 18, 2022 at 10:50
  • 8
    Just the chrome://restart worked for me
    – Zymotik
    Oct 31, 2022 at 18:07
  • 1
    If this worked, it doesn't now. Thanks, Google.
    – Nilpo
    Jan 31, 2023 at 9:13
  • Works for me, Chrome Version 112.0.5615.86. This should be marked as correct answer. +1!
    – CoolBots
    Apr 18, 2023 at 18:58
  • 1
    This should be the accepted answer. Just the chrome://restart was enough.
    – ODaniel
    Jun 22, 2023 at 9:15
15

Many problems with SSL certificates can be solved by simply removing the file from the cache folder.

In Chrome or Chromium, the file to be removed is cert9.db in the folder ~/.pki/nssdb. (In Firefox, you’d want to remove cert8.db.)

Attention! After removing these files, you will need to re-register CAs in your browser.

This is solution is for linux systems, the steps for Windows users would be somewhat different.

Improve this answer
4
  • 8
    It would be good if you could elaborate or provide links regarding re-registering CAs.
    – Mike Shultz
    May 6, 2017 at 6:45
  • It seems that quitting and restarting chrome works after this
    – Ian Turton
    Oct 16, 2017 at 11:06
  • 2
    ~/.pki folder doesn't exist for me (on Mac) - and lack of explanation about re-registering CAs seems like a big oversight. Also, "on Windows, somewhat different" is not particularly helpful; if you don't know how to fix it for Windows, just say "this is a *nix-only solution"
    – dwanderson
    Jun 27, 2018 at 19:04
  • This worked for me, thanks! Ubuntu 18.04 / Linux.
    – dusoft
    Feb 3, 2020 at 21:38
5

As far as I know, certificates are not specific to Google Chrome (at least on Windows) but to the whole system. You’ve already deleted that cert through Chrome’s interface, so it should gone.

Just to be certain, you could try.

Start → Run → certmgr.msc

Another tool to try is CCleaner. It should help with better cleaning of Chrome’s caches.

Improve this answer
4
  • 1
    Tried certmgr.msc and I don't see the cert in there. Like you said it is clearly gone since the other browsers do the right thing, maybe this is just a chrome bug of some sort
    – Foovanadil
    Jun 13, 2011 at 18:36
  • So ... did you had any luck so far? Have you tried CCleaner as suggested? .. or any other tool?
    – LazyOne
    Jun 14, 2011 at 9:00
  • I ran CCCleaner and looked at what it wanted to delete and it was nothing more than what Chrome will delete (Just cookies and session info).
    – Foovanadil
    Jun 14, 2011 at 16:38
  • 1
    if that is true, why incognitive mode works?
    – Jose Nobile
    Feb 6, 2017 at 5:38
3

For Windows 10, there is a way to clear only OCSP and CRL information without clearing Chrome history.

More details can be found from Mr. Dimcev's blog post http://www.carbonwind.net/blog/post/Viewing-clearing-and-disabling-the-OCSP-and-CRL-cache-on-Windows-7.aspx

Running the suggested certutil -urlcache ocsp delete is likely to result in FAILED: 0x80070020 (WIN32: 32 ERROR_SHARING_VIOLATION) if Chrome is running.

Improve this answer
1
  • 2
    This was the solution that worked for me and enabled me to get past the cached certs.
    – Black Dynamite
    Nov 18, 2020 at 19:47
2

I confirmed this worked for me on Windows 10:

  1. Pre-requisite: Certify (use another computer with no "knowledge" of your site) that your server serves the new certificate to brand new computers, at least.
  2. Clear the cache of Chrome. I chose to clear all three options presented when using CTRL+SHIFT+DEL: History, Cookies, and Cached. However, you can probably keep your history.
  3. Close chrome, and using the Task Manager, certify that there is no chrome.exe running. I think chrome caches the certificate in memory.
  4. Re-open chrome and visit the site. Your chrome browser should now pull the latest certificate and not use the cached one.
Improve this answer
2
  • Wiping entire history seems way too powerful method to remove OCSP-info for a single site. Is there really no alternative?
    – Jari Turkia
    Feb 19, 2020 at 12:29
  • @JariTurkia, I bet you could actually keep your history. I've updated my answer to suggest this. Your answer could still be helpful for users who want to keep all their cached site data.
    – Christopher
    Feb 19, 2020 at 16:16
0

Given quite a lot of complicated and incorrect answers: Chrome caches certificates and does not have an option to remove them. However you can just force it to get a new one, for example if the website is "www.domain.com" you open "domain.com". This will make Chrome re-download the (same) certificate which then refreshes both.

Improve this answer
2
  • This isn't true. Not every certificate works for both www. and no www. domains. A single-domain certficate could be either one and servers can be configured to serve either one or both.
    – Nilpo
    Jan 31, 2023 at 9:18
  • Also not every webserver does have a www domain or the domain without configured, also not every DNS has both variants resolving. In the majority of cases this will work fine, I've been using it all my life. Alternatively you can still go and close Chrome, remove the cache files manually, start Chrome again.
    – John
    Feb 1, 2023 at 14:53
-3

More accurate way:

Ctrl+Shift+Del ( or Settings > Advanced > Clear browsing data )

[ Time range: All time ]

  • Chached images and files

press: Clear data

Improve this answer
1
  • 4
    the OP already said he cleared his cache, so for this 7 years old question this answer will not help the op.
    – Dennis Nolte
    Sep 24, 2018 at 9:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .