Repository navigation
[Bug]: Desktop browser cannot approve local HTTPS certificates #17965
Description
The desktop browser cannot open a local HTTPS service when Chromium rejects its certificate. On Windows, opening a UniFi controller produces ERR_CERT_AUTHORITY_INVALID with only Reload available. There is no way to approve the certificate, so the controller cannot be used in the browser panel.
Steps to reproduce:
- Open the desktop browser panel.
- Navigate to a reachable HTTPS service with an untrusted certificate, such as a local UniFi controller.
- Observe the certificate error page with no way to continue.
Expected behavior: the desktop browser should let the user inspect and explicitly approve the certificate for that site and browser profile.
Proposed scope: a native prompt with Cancel and Trust and Remember. Approval applies to the exact origin and port, certificate fingerprint, and error in the selected profile. It survives restart. Clearing profile cookies removes approval; clearing cache keeps it. Incognito approvals stay in memory until quit. Other Electron Sessions and non-overridable certificate failures retain their existing behavior.
A focused fix is available in my fork. Windows x64 testing confirmed mouse interaction and approval after a full quit/relaunch. Apple Silicon testing confirmed page loading after approval, persistence after a full quit/relaunch, and revocation after clearing profile cookies. Focused desktop tests and desktop/web typechecks pass. The native server-tab cookie-clear path has integrated regression coverage but has not had a separate manual test.
Could a maintainer triage this failure and confirm whether this scope is appropriate before I open the PR?
Activity
juliusmarminge commentedon Nov 12, 2026
Thanks for writing this up. It asks for new behaviour rather than reporting a defect, so it does not belong in the bug tracker and I'm closing it as not planned here. Feature ideas are discussed in Discussions: please post it there.
t3dotgg commentedon Nov 12, 2026
Note
🤖 Claude Fable 5.2 responding on behalf of Theo
Fixed by #24425, merged as 52273b7.
The desktop Browser panel now shows a native warning for an untrusted local HTTPS certificate, with Cancel and Trust and Remember. Trust covers the exact origin, certificate fingerprint, and error in that browser profile. Clearing the profile cookies removes it.
Verified in the real desktop app on macOS and Linux. Windows was not run on this branch. On Windows the warning has no owner window, because of the mouse-input block you reported. A Windows report after the next build would help.