Fix ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN on Chrome
Quick Answer: The ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN error in Chrome indicates that the server's SSL certificate chain does not contain a public key that Chrome has previously pinned for that domain. This often results from a server-side certificate update where the new certificate's public key hash doesn't match a stored pin. To resolve, clear Chrome's HSTS/certificate cache for the domain by navigating to chrome://net-internals/#hsts, entering the domain, and clicking 'Delete domain security policies'. The expected result is that Chrome will re-evaluate the certificate and establish a connection.
What Causes This Error
- Server-side certificate update with a new public key that does not match a previously pinned key hash stored in the client's browser or operating system's HSTS/HPKP cache.
- Incorrectly configured HTTP Public Key Pinning (HPKP) headers (e.g., `Public-Key-Pins` or `Public-Key-Pins-Report-Only`) sent by the server, causing Chrome to pin an invalid or temporary key.
- Man-in-the-Middle (MitM) attack or proxy interference attempting to present a fraudulent certificate, which naturally wouldn't match the legitimate pinned key.
- Local system time skew or misconfiguration, leading to certificate validation failures where Chrome incorrectly perceives the certificate as expired or not yet valid, indirectly affecting pinning.
- Corrupted Chrome profile data, specifically the HSTS/HPKP cache, which can lead to stale or invalid pinned key entries for certain domains.
Step-by-Step Fixes
Fix 1: Clear Chrome's HSTS/HPKP Cache for the Specific Domain
Open a new tab in Chrome and navigate to `chrome://net-internals/#hsts`.,Scroll down to the 'Delete domain security policies' section.,In the 'Domain:' input field, enter the exact domain name (e.g., `example.com`) that is presenting the `ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN` error.,Click the 'Delete' button next to the input field.,Close and reopen Chrome, then attempt to access the website again.
Fix 2: Update or Disable Browser Extensions
Open Chrome and navigate to `chrome://extensions`.,Toggle off all extensions by clicking their respective blue slider buttons.,Attempt to access the problematic website. If the error is resolved, re-enable extensions one by one to identify the culprit.,Once identified, check the extension's settings for any SSL/TLS or network proxy configurations, or update it to the latest version. If the issue persists, consider disabling or removing the problematic extension.
Fix 3: Check System Date and Time Settings
On Windows: Right-click the clock in the taskbar, select 'Adjust date/time', and ensure 'Set time automatically' and 'Set time zone automatically' are enabled.,On macOS: Go to System Settings > General > Date & Time, and ensure 'Set date and time automatically' is checked.,On Linux: Use `sudo ntpdate pool.ntp.org` or ensure `systemd-timesyncd` is active. Verify with `date` command.,Restart Chrome after correcting any time discrepancies and re-attempt to visit the site.
Fix 4: Temporarily Disable Antivirus/Firewall SSL Inspection
Access your antivirus or firewall software settings (e.g., Avast, Kaspersky, ESET, Windows Defender Firewall).,Locate features related to 'SSL/TLS scanning', 'HTTPS inspection', 'Web Shield', or 'Encrypted connection scanning'.,Temporarily disable these features. Note: This may reduce your security posture, so re-enable them after testing.,Restart Chrome and try accessing the website. If the error is resolved, consult your security software's documentation for configuring exceptions or updating its root certificates.
Advanced Fixes
Advanced Fix 1: Inspect Server HPKP Configuration (Server Administrator)
Use an online SSL checker tool (e.g., SSL Labs by Qualys) to analyze the website's current SSL configuration and check for `Public-Key-Pins` or `Public-Key-Pins-Report-Only` headers.,Verify that the `pin-sha256` directives in the HPKP header accurately reflect the public key hashes of the current certificate chain, including backup keys.,If the pins are incorrect or expired, update the web server configuration (e.g., Apache `.htaccess`, Nginx configuration) to remove or correct the `Public-Key-Pins` header. Consider using `Public-Key-Pins-Report-Only` for a transition period.,Ensure the `max-age` directive is set appropriately, allowing enough time for clients to receive new pins before old ones expire, but not so long that recovery from misconfiguration is impossible.
Advanced Fix 2: Analyze Network Traffic for MitM Activity
Utilize a network packet analyzer like Wireshark or Fiddler to capture HTTPS traffic when attempting to access the problematic site.,Examine the TLS handshake details, specifically the server's presented certificate chain. Look for unexpected root CAs, intermediate certificates, or discrepancies in serial numbers/public keys.,Compare the certificate details against known legitimate certificates for the domain (e.g., from a trusted device or an SSL checker).,If suspicious activity is detected, investigate local proxy settings, VPN configurations, and perform a comprehensive malware scan on the affected system.
FAQs
Q: What exactly is 'SSL Pinning' and why does Chrome use it?
A: SSL Pinning, specifically HTTP Public Key Pinning (HPKP), is a security mechanism where a web server tells the client (like Chrome) to remember (pin) one or more public keys associated with its certificate chain for a specified period. Chrome uses it to prevent Man-in-the-Middle (MitM) attacks, even if an attacker manages to obtain a certificate from a trusted Certificate Authority (CA). If a future connection presents a certificate chain without one of the pinned keys, Chrome rejects the connection with `ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN`.
Q: Is clearing HSTS cache safe? Will it affect other websites?
A: Clearing the HSTS cache for a specific domain using `chrome://net-internals/#hsts` is generally safe and only affects that domain's security policies. It will not impact other websites. Chrome will simply re-evaluate the certificate chain and HSTS headers on the next visit to the affected domain. Clearing the *entire* HSTS cache (e.g., via 'Clear browsing data' with 'Hosted app data' checked) would remove all such policies, which is also generally safe but might slightly reduce initial security for some sites until their HSTS policies are re-established.
Q: Could this error indicate a real security threat?
A: Yes, absolutely. While often caused by server-side certificate updates or misconfigurations, `ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN` is specifically designed to alert you to potential Man-in-the-Middle (MitM) attacks. If you encounter this error unexpectedly on a well-known site, especially after verifying server-side changes are not the cause, it warrants further investigation, such as scanning your system for malware or checking your network for suspicious activity.
Q: Does this error occur in other browsers like Firefox or Edge?
A: While the specific error code `ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN` is Chrome-specific, other browsers implement similar certificate pinning mechanisms. Firefox uses its own pinning list and may show `MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED` or `SEC_ERROR_UNKNOWN_ISSUER` if a pinned certificate is violated. Microsoft Edge, being Chromium-based, would likely display the same `ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN` error.