[SOLVED] SSL on Localhost (Windows)

[kongondo]

So, all of a sudden, Chrome is blocking all of my localhost sites, claiming my connection is not Private, blah blah..Here is the full text of what Chrome is telling me.

Quote

blog.sandpit.dev normally uses encryption to protect your information. When Google Chrome tried to connect to blog.sandpit.dev this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be blog.sandpit.dev, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged.

You cannot visit blog.sandpit.dev right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.

I get no option to 'continue to this unsafe site'. 

It seems I have no option but to install SSL on my local sites. I have seen some articles on how easy it is to do in a Mac but I am on Windows. Anyone has pointers on how I can do this? Alternatively, anyone knows what this Chrome error is about? Bottom line is, unless I change browsers, I am not currently able to develop and test stuff locally. Grr!

Thanks.

[horst]

are you not able to test and develop those sites without SSL? (configuring your local sites to run under http: and https: besides each other)

[fbg13]

https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/

[horst]

what is about using the .local tld? Is it forced to https too?

[kongondo]

10 minutes ago, horst said:

are you not able to test and develop those sites without SSL? (configuring your local sites to run under http: and https: besides each other)

Not on chrome. It is blocking the connection and tells me what I've quoted above. Hence, I am thinking if I migrate to SSL, Chrome will let me through.

9 minutes ago, fbg13 said:

https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/

Thanks. I'll have a look.

7 minutes ago, horst said:

what is about using the .local tld? Is it forced to https too?

I haven't tried this. The issue is that I have been using the same .dev tld forever. This problem with Chrome just started this afternoon.

[kongondo]

11 minutes ago, fbg13 said:

https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/

Bingo! That was it! Grr Google! I'll take the easy way out and just rename to .local. 

Thanks guys.

[horst]

as far as I could see by a quick glance over the url provided by @fbg13, it is due to that G**gle has owned some .dev tlds, and that chrome (now) implements a HSTS.

So best bet would be to change to .local what never will change to become a public tld.

Or you installs LetsEncrypt on windows. (not really)

 

Edit: ok, you were faster in reading than I was in writing.

Edited December 14, 2017 by horst

[fbg13]

.foo is another tld they they force https on, here is a blog post by google https://security.googleblog.com/2017/09/broadening-hsts-to-secure-more-of-web.html

[horst]

ah, it need some clicks to finally get the list displayed: https://publicsuffix.org/list/public_suffix_list.dat

 

[SamC]

I read the opening post earlier and I was like wha? Just now I loaded up my localhost pw.tuts.dev and BOOM! "Your connection is not private". The same damn site I was working on like 6hrs ago without issue. Now I gotta change my hosts and vhosts and all that crap. Looks like I'll be going down the .local route.

Thanks for the answers here everyone.