Failure to clear "Not Secure" indicator when a site gets a new SSL certificate

@dscotese as other person mentioned, no such thing appearing here. Perhaps you need to clear the site data for that site, assuming that it’s pulling from cache of your prior visit. Have you tried in a private window or anything?

I had some thought and decided to check with ChatGPT. I think it’s going with what I was mentioning earlier. Figured I’d paste it in to see what you think.

From the screenshot and description in the post, it looks like the issue might be related to caching or how Brave is handling the expired certificate state after the renewal. Here’s what could be happening:

  1. Browser Cache: After the SSL certificate expires, Brave might cache the fact that the site was previously insecure. Once the certificate is renewed, the browser may still be holding onto this information in its cache, leading to the persistent “Not Secure” warning despite the valid certificate. A hard refresh (Ctrl + F5) or clearing the browser cache might resolve the issue.
  2. HSTS (HTTP Strict Transport Security): If the site was flagged as non-secure before the SSL certificate renewal, Brave might have cached the site’s state using HSTS. Even though the certificate is valid now, the browser could still remember the insecure state.
  3. SSL State Cache: Browsers like Brave store SSL certificates in a separate cache (sometimes called the SSL state). Even after renewing a certificate, if this cache isn’t refreshed, the browser might still show the old security state. Flushing the SSL state can fix this issue.

Steps to Resolve:

  • Hard Refresh: Try refreshing the page with Ctrl + F5 to force the browser to reload the page without using the cache.
  • Clear Cache: Go to the browser settings and clear the cache, particularly for the affected site.
  • Clear SSL State: If clearing the cache doesn’t work, try clearing the SSL state from the browser settings.
  • HSTS Preload: If the site is using HSTS, you might need to wait for Brave to refresh the HSTS status or manually clear it via the browser’s settings.
1 Like