My Chrome (40.0.2214.115m) jumps to non-existent https :
I type in
And Chrome redirect to
http s ://johnwhitech.homeip.net:8080/
which does not exist. I do not have HTTPS everywhere.
In network analyzer, I see that my server answered a 307 redirect which is not true (apache is configured correctly and does not gives this answer, other browsers don't redirect, HTTP packets loop perfectly normal).
I tried to log the request with fiddler, here is it :
CONNECT johnwhitech.homeip.net:8080 HTTP/1.1
Host: johnwhitech.homeip.net:8080
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/40.0.2214.115 Safari/537.36
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
…
Other strange thing : in the HOST column of fiddler, if I try with firefox, I see my server name. With chrome, I only see "Tunnel to…" even for the very first request. The protocol is indeed HTTP (look at the beginning of the packet), but why on hearth my chromes sends a SSL "ClientHello" along with it ?
Is it a normal behavior ?
The only thing I see that might be related to SSL is that I installed a self-signed certificate, first via chrome settings, then system-wide. This certificate works well, but maybe since the domain name matches a certificate in the list, chromes tries SSL ?
Thanks folks !
EDIT3 : This behavior also happens without internet connectivity (cache cleared), so definitely not on the server-side
EDIT4 : What I see in the "NETWORK" tab of Chrome Dev Tools. The first entry is normal, the second entry is via HTTP which gets immediably redirected to HTTPS. This happens with no network connection, in particular the server is not sending HSTS.
Best Answer
Chrome clearly states the reason: HSTS. HSTS, once received, sticks. This is an essential part of the concept. This means that if Chrome received a HSTS header from your server, even if only once, it will stick until it expires.
To check Chrome’s HSTS cache, go to
chrome://net-internals/#hsts. From there, you can query the cache. Unless it reports “Not Found”, Chrome has a cached HSTS header from your page. To remove it, use the tool provided on the same page.