How to Clear or Disable HSTS for Chrome, Firefox and Internet Explorer

Incorrectly configured HSTS can block access to the website and cause issues like NET::ERR_CERT_AUTHORITY_INVALID. These problems are so frustrating to many users that they disable or clear its settings.

HSTS: For the sake of clarification, please, what is HSTS?.

In other words, HSTS forces browsers to only create secure HTTPS connections to certain websites to prevent attacks such as SSL stripping, which degrade connections to HTTP. However, HSTS may also be the cause of warnings including "Your connection is not private" and a further block to website access without an enabled bypass if the SSL/TLS certificates are set up wrongly or have expired.

It needs to be an issue with HSTS, considering the website is accessible through different devices or browsers. The issue can be temporarily and insecurely fixed by disabling/clearing HSTS.

Step 1: Disable HSTS in Chrome

You will typically get this "Your connection is not private" message if something goes wrong with Chrome's settings related to HSTS. There is an indication in the Advanced menu relating to HSTS. For example, you might also get an indication like "You cannot visit *website name* because the website uses HSTS". This page will likely work fine at some point in the future because network troubles and attacks are often transient.

Start Chrome and copy the following URL and paste into the address bar: chrome://net-internals/#hsts.

Then check that Domain Security Policy is expanded. So, in order to delete HSTS settings for a particular domain - under Query HSTS/PKP domain find Domain box and enter the domain name. A set of numbers will appear:.

Once the values have populated, scroll down to Delete domain security policies. In the box, type the same domain name to delete the HSTS settings and click the Delete button.

After you restart Chrome, access the website that you disabled in HSTS settings. You should access the website unless the issue was with the HSTS settings.

2. Delete or disable HSTS in Firefox

For disabling or clearing your HSTS settings, Firefox offers a bit more than Chrome. While we are going to start with the methods of automatic approach, the manual ways too are discussed.

2.1. Forget the Website to Clear the Settings

Open Mozilla Firefox and kill all the active windows or tabs.

Opening the Library menu is done via Ctrl + Shift + H, or Cmd + Shift + H for Mac users.

To remove the HSTS settings of a website, find it first. To find what you are looking for, use the search box on the top right.

To remove a website, find it, then right-click and select it to erase all the cached data along with the HSTS settings from this domain.

To see if this is the solution to the problem, start Firefox. The settings of HSTS-related problems should no longer interfere with your normal access to websites.

If you want to delete only HSTS settings without deleting all the cached data or if this didn't work, then you can try another method below.

2.2 Clearing HSTS by Removing Site Preferences

Click the Library icon at the upper right part of Firefox's main menu, then History > Clear Recent History.

In the Clear All History box, select Everything from the Time range to clear drop-down menu.

Next, in the Details menu, everything should be cleared off, including the option Site Preferences.

Click Clear Now to send the site back to its default setting.

Then, try restarting Firefox to see whether or not it fixes the problem.

2.3. Clear HSTS Setting by Editing User Profile.

Close all Firefox windows, tabs, and windows, and quit Firefox.

Go to your Firefox profile directory. You might want to try these paths: "C:Users*YourUsername*AppDataLocalMozillaFirefoxProfiles" file path The path for Mozilla Firefox profile in the case of Mac is C:Users*YourUsername*AppDataRoamingMozillaFirefoxProfiles /Users/*YourUsername*/Library/Application Support/Firefox.

Note: Type "about:support" in the navigation bar and press Enter. Your user profile will be appeared. Click Open Folder in the Profile Folder section under Application Basics. When you are done using Firefox, close it completely.

Open the Profile Folder and find the file SiteSecurityServiceState.txt. You can then open it with a text editor. You will find your HSTS and HPKP preferences that were saved in this file.

In order to remove an HSTS setting of any domain, just remove the whole entry and save the .txt file. Be really careful because of the chaotic nature not to remove any other information. A typical example of a HSTS entry would be appual.disqus.com:HSTS 0 17750 1533629194689,1,1,2.

Note: You could also rename the file from .txt to .bak in order for Firefox to create a new file and hence delete all previous HSTS settings.

whether the problem persists after saving and closing SiteSecurityServiceState.txt, try restarting Firefox, in an effort to see if this actually fixes it.

Section 2.4: How to Disable HSTS in Firefox

Press the "about:config" on the Firefox address bar. In order for you to enter into the advanced options menu, click the "I accept the risk!" button.

You can find the relevant preferences by typing "hsts" into the search box in the top right of the page.

Double-click on secure.mixed_content

In order to disable HSTS in Firefox toggle the preference use_hstsc.

3. Deleting or Disabling HSTS in Internet Explorer

HSTS is enabled by default on both Internet Explorer and Microsoft Edge. They will be treated as key security attributes. You should not attempt to turn off HSTS on any of these browsers. But, if necessary, you can do that in Internet Explorer.

Note that the procedure is somewhat longer than typical when it involves an x64-based system rather than an x86-based system.

Press the Windows key plus R to open a Run box. Type in regedit and press Enter to open the Registry Editor.

Then go to this path: The Main Feature Control key is located under the HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet Explorer key.

Right-click the FeatureControl key and choose Keys > New, and name the key FEATURE_DISABLE_HSTS.

Under FEATURE_DISABLE_HSTS, right click and choose Options > New > DWORD (32-bit) value.

Name it as "iexplore.exe" and press Enter.

Right-click the file and choose "Modify" to give the value to iexplore.exe as 1. Click OK.

Save and restart for changes to take effect on x86 systems. If your system is x64, then read further below.

For Main Feature Control, go to:HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet Explorer.

Repeat the steps from above like creating FEATURE_DISABLE_HSTS and iexplore.exe as stated above.

Click OK after giving Value data as 1 and then double-click iexplore.exe.

Now, restart your computer to apply the change. Open Internet Explorer to verify that HSTS has been disabled.

We hope you are able to manage the configuration of HSTS for your needs and keep your security posture sound.