68

I am getting an error net::ERR_INSECURE_RESPONSE in the Chrome console when fetching some data from my API

This error usually occurs as a result of an unsigned certificate; however, it is not an issue with this because I have a valid and signed certificate.

The error doesn't happen often at all and it goes away if I restart my Chrome browser. It also doesn't occur in any other browser at all (tested on Safari, Mozilla, Opera)

Any idea why this is happening? Is this just a browser bug?

2
  • 2
    I also have this issue, but it's 100% repeatable at a client site and 0% repeatable outside of it. I also am using a valid and signed cert which makes nearly all info on the web unusable as it's already referring to self-signed certs.
    – kirps
    Aug 22, 2016 at 19:52
  • Is the API you're contacting also on a SSL?
    – artur99
    Feb 14, 2017 at 8:09

8 Answers 8

80

This happens when you update from Chrome 55 to Chrome 56 (56.0.2924.87).
This is an increase in security enforcement.
It doesn't go away by restarting the browser, and it's not a bug.

Mountain View says it's hoping you don't ever encounter the message, because Certificate Authorities are required to stop issuing SHA-1 certificates in 2016. Just in case, Google plans to continue issuing warnings until Chrome completely stops supporting SHA-1 on January 1st, 2017. When that day comes, a website that still uses the function will trigger a fatal network error. (Source: Engadget.com)

If this happens, the most-likely cause is that your (or the website's) SSL-certificate uses SHA1.
SHA1 is broken, and SSL certificates using SHA1 are not secure anymore (it's now been a long time that Chrome showed this to you - now it blocks NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM).

Another likely cause is that your SSL-certificate expired
Also, you should disable backwards-compatiblity with SSL2 & SSL3 (Poodle Attack).
You should only be using TLS (SSL 3.1+).

To test your domain's SSL-certificate, you can use SSL labs SSL test.

To find out what exactly the issue is: Open the chrome developer console (CTRL + SHIFT + J OR F12) And change to the security tab

Security

Console

Details

For more information:
https://support.google.com/chrome/answer/95617?visit_id=1-636221396724527190-3454695657&p=ui_security_indicator&rd=1

FYI:

SHA-1 has been growing weaker and more insecure everyday for a decade now, which is dangerous considering we tend to trust websites with "https://" in their URLs. Other browsers like Mozilla Firefox and Microsoft Edge also plan to stop supporting it in an effort to encourage website owners to switch to more secure SHA-2 certificates as soon as possible.

If you urgently need to get around it (you need to close all running instances of Chrome first - otherwise it won't work):

chrome --args --ignore-certificate-errors

Please note: don't go online-banking or gmail'ing with those command-line settings active in your Chrome instance.

3
  • Hi - Great Explanation! I set up my cert with this tutorial successfully, digitalocean.com/community/tutorials/… But now I've been getting this error every time I try to load scripts. Any thoughts on how to upgrade? I thought this was the most recent option available. Apr 4, 2017 at 17:06
  • I had fixed that for mac by command 'defaults write com.google.Chrome EnableSha1ForLocalAnchors -bool true' and restart chrome. There are different details about how to perform enableSha1ForLocalAnchors on other OS.
    – okutane
    Jun 13, 2017 at 11:57
  • Another cause is that you're a web developer using a self-signed cert. Thanks Google. Jan 25, 2018 at 22:41
65

I had a similar issue recently. I was trying to access an https REST endpoint which had a self signed certificate. I was getting net::ERR_INSECURE_RESPONSE in the Google Chrome console. Did a bit of searching on the web to find this solution that worked for me:

  1. Open a new tab in the same window that you are trying to make the API call.
  2. Navigate to the https URL that you are trying to access programmatically.
  3. You should see a screen similar this: enter image description here
  4. Click on Advanced > proceed to <url> and you should see the response (if there is one)
  5. Now try making the API call through your script.
5
  • I hope you're not using this to transmit confidential information (credit card payment). If you have an internal self-signed certificate, obviously the right approach is to add the certificate to the trusted certificates on the machine/domain (or mozroots on Linux). Unsafe will ignore any and all certificate errors - meaning using SSL is completely pointless, you could as well be using HTTP. Sep 11, 2017 at 11:51
  • 2
    This answer was very useful. Thanks! Oct 5, 2017 at 12:09
  • Yeah, I used the same trick, but using a real certificate seems to be the only viable way around. Dec 6, 2017 at 12:05
  • @StefanSteiger It's complicated to setup, has impact on the source code, works differently between dev/staging/prod envs. Basically, another layer of complexity. Also, let's encrypt doesn't provide certificate for IP addresses, so using a DNS routing is necessary to get a domain name. Would be even worse if it wasn't free, wouldn't like to pay for certificate in staging environment for instance. I'm not complaining about let'sEncrypt, but rather about the whole complexity around certificates in general. Especially for a beginner and non sys-admin. Dec 8, 2017 at 10:58
  • @Vadorequest: Can't say I find setting up SSL difficult. Maybe you shouldn't use braindead server software such as apache or IIS. Also, you can setup SSL on dev&staging too, so there will be no difference between the environments. Also, if your test-environment is different form your prod-environment, it's not really a test-environment, then it's just a superfluous step. Jan 23, 2018 at 9:48
2

A missing intermediate certificate might be the problem.

You may want to check your https://hostname with curl, openssl or a website like https://www.digicert.com/help/.

No idea why Chrome (possibly) sometimes has problems validating these certs.

2

I was getting this error on amazon.ca, meetup.com, and the Symantec homepage.

I went to the update page in the Chrome browser (it was at 53.*) and checked for an upgrade, and it showed there was no updates available. After asking around my office, it turns out the latest version was 55 but I was stuck on 53 for some reason.

After upgrading (had to manually download from the Chrome website) the issues were gone!

2

For me the answer to this was available here on StackOverflow:

ERR_INSECURE_RESPONSE caused by change to Fiddler's root certificate generation using CertEnroll for Windows 7 and later

Unfortunately, this change can cause problems for users who have previously trusted the Fiddler root certificate; the browser may show an error message like NET::ERR_CERT_AUTHORITY_INVALID or The certificate was not issued by a trusted certificate authority.

(Quote from the original source)

I had this ERR_CERT_AUTHORITY_INVALID error on the browser and ERR_INSECURE_RESPONSE shown in Developer Tools of Chrome.

0
1

Maybe you have run into this problem: net::ERR_INSECURE_RESPONSE

You need to check the encryption algorithms supported by your server. For example for apache you can configure the cipher suite this way: cipher suite.

Which version of chrome are you running and what is the server serving your APIs?

2
  • 1
    don't think this is the issue because restarting the browser makes this issue go away
    – Karim
    May 31, 2016 at 14:27
  • 1
    and using chrome 50.0.2661.102 and using Rails to serve up my API. However, like I mentioned, can't consistently reproduce this issue as closing out of the browser makes everything work again so doesn't seem to be an issue with encryption algorithms
    – Karim
    May 31, 2016 at 14:29
1

I was having this issue when testing my Cordova app on android. It just so happens that this android device does not persist its date, and will reset back to its factory date somehow. The API that it calls has a cert that is valid starting this year, while the device date after bootup is in 2017. For now, I have to adb shell and change the date manually.

1

Don't know if this question is relevant anymore, but this happened to me on a client wich had an incorrect datetime set on Windows. This will be an alternative to watch. If is this case, it will reproduce on other browsers as well (at least, on firefox and chrome).

I fixed it updating datetime on Windows to actual's real datetime. Hope it helps somebody.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.