How to Safely Delete the Google Chrome ‘HSTS Settings’ (Fix SSL/TLS Certificate Errors)

HTTP Strict Transport Security (HSTS) is a security policy that websites use to force web browsers, like Google Chrome, to only connect using a secure, encrypted HTTPS connection. When you visit a highly secure site, Chrome silently saves that site’s domain in a hidden HSTS database on your hard drive.

However, if you are a web developer working on a local testing server (like localhost) or if a website recently downgraded its security certificate for maintenance, this hidden HSTS setting will completely lock you out. Chrome will display a permanent “Your connection is not private” (ERR_CERT_AUTHORITY_INVALID) screen and remove the “Proceed anyway” button entirely. Because HSTS settings are hardcoded, clearing your standard browser cache will not fix it. You must manually delete the domain from Chrome’s internal security database.

How to Safely Delete Chrome HSTS Settings for a Specific Domain

You must use Chrome’s hidden Net Internals diagnostic page to query and delete the HSTS policy.

1. Open the Google Chrome browser.
2. Click on the address bar at the top of the window, type the following exact URL, and press Enter: chrome://net-internals/#hsts
3. You will be taken to a bare-bones diagnostic page dedicated entirely to Domain Security Policy.
4. Scroll down to the absolute bottom of this page until you find the section labeled Delete domain security policies.
5. In the text box labeled Domain:, carefully type the exact URL of the website you are trying to access (for example, type localhost or example.com). Do not include the http:// or https:// prefix.
6. Click the Delete button next to the text box.

Chrome will silently and instantly erase that specific domain’s strict security requirement from its database. Open a new tab and navigate to the website again. Chrome will now allow you to connect normally, bypassing the permanent SSL/TLS certificate block.