Something called HSTS suddenly started blocking access to many web sites

[Bob Ford]

I use Opera 63.0 with HTTPS installed. My computer is a Mac Mini using OSX 10.11.6 (El Capitan).

Something called HSTS suddenly started blocking access to many web sites today — Thursday, October 3 — with no prior warning or indication or anything. I am now unable to access some of my most important and most frequently accessed sites. Even CNET Mac Forums was blocked. I'm glad I was able to access this site.

I get this instead:

Your connection is not private

This server could not prove that it is [ domain name ]; its security certificate is from ereservations.att.com This may be caused by a misconfiguration or an attacker intercepting your connection.

NET::ERR_CERT_COMMON_NAME_INVALID

Or I get this:

This site can't be reached

The web site at [ domain name ] might be temporarily down or it may have moved permanently to a new address.

ERR_CERT_COMMON_NAME_INVALID

Can anyone help me?

 

[chscag]

The obvious question we have for you is have you tried accessing those sites with another browser?

 

[Randy B. Singer]

I use Opera 63.0 with HTTPS installed. My computer is a Mac Mini using OSX 10.11.6 (El Capitan).

Something called HSTS suddenly started blocking access to many web sites today — Thursday, October 3 — with no prior warning or indication or anything. I am now unable to access some of my most important and most frequently accessed sites. Even CNET Mac Forums was blocked. I'm glad I was able to access this site.

I get this instead:

Your connection is not private

"HTTPS" is not something that you have "installed." It is a protocol used by Web sites for higher security. Not all Web sites are available via HTTPS, and your browser appears to be set to only connect to Web sites that offer a HTTPS version.

HTTPS - Wikipedia

The solution is to turn your security settings down so that your browser is not set to connect only via HTTPS.

I can't help you with that as I don't use Opera. If you can't figure out how to properly set Opera's security settings, may I recommend an alternate browser that I suspect that you will like better anyway?

Brave (free)
Features | Brave Browser

Brave is FAST, it blocks ads and trackers automatically, it's secure, and if you need heightened security there are several optional settings for that.

 

[Bob Ford]

Yes, with Safari. Same result.
What I installed is HTTPS Everywhere, downloaded from the Electronic Frontier Foundation (eff.org). I've used it for a long time. This problem appeared out of nowhere just today (Oct. 3). I've made no change in Opera's or Safari's security settings in a long time. How do I turn my security settings down?

I will check out Bravo. Thanks for the tip. I would like to keep using Opera too, if I can resolve this problem.

 

[IWT]

@Bob Ford

You could reconsider the value of your downloaded app - HTTP Everywhere (HTTPS Everywhere | Electronic Frontier Foundation). HTTPS Everywhere is produced as a collaboration between The Tor Project and the Electronic Frontier Foundation.

This is the cause of the "problem", but it's only doing its job, so to speak. Your call.

Ian

 

[chscag]

It should be noted that Bob is running El Capitan which I believe will soon no longer receive security updates by Apple. Also it appears the HTTPS web page says that their extension may not work with some sites.

 

[Bob Ford]

I thank all of you for your input.
I guess I need to get rid of HTTPS Everywhere and see if that works.
But I wish I could understand. My security settings on Opera and Safari have been unchanged for years. I have had HTTPS Everywhere installed for years. I never had this problem until Thursday, Oct. 3.
Why such a catastrophic change all of a sudden?

 

[Raz0rEdge]

The problem isn't with the browser or the extension itself, but rather sites where the certificate expires or is somehow mismatched. In that case, you are being blocked for your own protection.

I had that extension for a while, but you don't really need it anymore, back in the day most sites had both HTTP and HTTPS versions of their websites, but these days virtually all sites redirect HTTP to HTTPS. Additionally, recent browsers also default to using HTTPS for all URLs and fall back to HTTP only when necessary.