While not recommended, and I would run firefox developer edition for that, you can disable (make the value false) `security.ssl.enable_ocsp_stapling` in `about:config`. You will be able to view sites with invalid certs/config. But will still prompt you that that something is invalid, and you have the choice to proceed forward.

Again, I would not recommend doing that on vanilla Firefox, they have Firefox developer edition version for these reasons. And you can run both side by side.

That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX.

If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition!

> That's exactly the problem though.

Is it? The default options are for default users. Default users are dumb. It sounds like you have a non-standard case and the capacity to know the difference between misconfiguration and actual threats. It also makes sense that you are able to turn off certain features for default users when you want to do non-standard (default) tasks.

> That's exactly the problem though. I know it's somehow possible, but the fact that I have to search for what's the internal boolean name for whatever feature I want to disable is simply a bad dev UX.

I think as a developer, searching for things are just part of the job, so if you have a niche need to debug or work with sites with invalid certs/configs, then it is not that hard to look on how to allow that. Firefox's docs are one of the best docs you can read to be fair.

> If there's a Firefox developer edition (I had no idea), they should enable all "I want to continue anyways" buttons by default. I mean, it's a developer edition!

To be honest, I use developer edition as my main browser and my profile is optimized and highly customized, so I don't remember is that was the default, or I changed it at some time (I keep it true).

But for vanilla Firefox which most of the users or potential users are not developers, I think this is reasonable default.

Compared to typing a nonstandard string in a nonstandard place? Going to about:config where all the deep settings are and searching for "ocsp" is downright obvious.

Not really... I don't even remember `about:config`. I know of its existence, but is it `config`, `:config`, or `about`, or ...?

So what I do is, I google, right? First page that comes up references how to fix the problem on both Firefox and Chromium-based browsers.

So on Firefox, I have to type the config page, then search for ocsp, then disable it. Then, I can finally access the webpage, but of course, I should remember to re-enable it after I'm done on the misconfigured server.

On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default.

Honestly, the latter is a vastly better experience in my world (I do backend/integration dev, mostly Python nowadays, probably a FE engineer will not care either way).

> On Chrome, I can fire up an incognito window, type a magic keyword, do what I need, close the incognito window and go back to default.

You can do the same on Firefox (at least developer edition). I thought that you want to do that without going to incognito mode.

How is searching for oscp obvious when the problem was HSTS?

I was just copying what someone else said in this thread. It might actually be network.stricttransportsecurity.preloadlist but I have not tried it.

It might be this, it might be that, it might be all sorts of things. The point is you have to know what it is for each scenario, then you have to know where to go change it, then you have to know what the variable name is. Or you can know "thisisunsafe" which, while not being something you'll find using the settings for your saturday reading material, is something easily found and universally applicable to all situations without simultaneously turning every other connection you make into a security risk.

It's a great hidden feature just like Firefox has shift+right click/double right click opening the native context. No amount of "well you can just put this in the console in these cases or this in the console in those cases" makes these kinds of features any less useful.

To be fair, "thisisunsafe" isn't exactly an advocated feature either.

I would like a better way to bypass these TLS errors, but hidden booleans and secret phrases aren't that dissimilar.

The biggest difference is a catch-all phrase vs feature-specific booleans. So rather than have one place for everything, you have multiple of booleans.

I agree that if there was at least one boolean to always show the "continue anyways" button, that'd be acceptable to me as well.

And I refuse use chrome because I use

full-screen-api.ignore-widgets

which makes videos full screen to the browser size.

Browsers need some advanced/i'm-a-dev mode. I'm getting sick of things (TLS details, urls, unsafe) getting hidden away/removed.

edit: Well comment below me just mentioned a Firefox developer version, wasn't aware of that.

This drives me up a wall. I know the site. I trust the site. Yes, they screwed up something with their configuration or it's just ancient. I STILL WANT TO GO THERE!