Chrome turning down webauthn for websites with TLS certificate errors

Web Authentication WG,

Starting on M110, Chrome will stop allowing WebAuthn requests on websites
with TLS certificate errors. The criteria will be the same used for showing
danger interstitials or a "Not secure" pill on the omnibox. This will
prevent bad actors from generating valid assertions by mitm'ing users who
may skip the interstitial.

For developers, this behaviour can be overridden by running chrome with the
--disable-features=DisableWebAuthnWithBrokenCerts flag. Enterprises can use
the AllowWebAuthnWithBrokenTlsCerts policy if needed as a workaround.

Happy hacking,
-- 

[image: Google Logo]
Nina Satragno
Ingeniera en Informática
she/her
nso@google.com