Chrome shows 'ERR_SSL_PROTOCOL_ERROR' or forces https:// for http://localhost or a local dev domain (HSTS); how do I get a working local HTTPS setup or clear the stuck HSTS entry?

Cause: two separate things often get mixed up. - HSTS: if a host once sent Strict-Transport-Security over HTTPS, the browser remembers it for max-age seconds and upgrades every later http:// request to https:// (the policy covers all ports of that host name, and includeSubDomains extends it to subdomains). If a different dev server now listens on that name over plain HTTP, the browser speaks TLS to a server that does not, and the connection fails with an SSL protocol error. IP addresses cannot be HSTS hosts, so http://127.0.0.1:PORT is not affected the same way. - A dev server that is not serving TLS at all, or one using a certificate the browser does not trust. Note that browsers treat http://localhost as a secure context already, so many features (service workers, clipboard, etc.) work there without HTTPS. Fix: 1. First check whether you need HTTPS: use plain http://localhost:PORT, or http://127.0.0.1:PORT, and confirm the dev server is listening on plain HTTP. 2. If you need HTTPS locally (secure cookies, a custom dev domain), use a local certificate authority tool such as mkcert: mkcert -install, then mkcert localhost 127.0.0.1 ::1 (add your dev host names). Point the dev server at the generated certificate and key files. Keep the mkcert root CA key private; it can intercept your machine's secure traffic. 3. To clear a stuck HSTS entry for a dev name, make the server send Strict-Transport-Security: max-age=0 over a working HTTPS connection once; the browser then drops the entry. In Chrome you can also delete the domain on chrome://net-internals/#hsts. Avoid sending HSTS from dev or staging servers with includeSubDomains. 4. Prefer a dedicated dev domain that you never use for production, so a production HSTS policy cannot affect it. Don't: click through certificate warnings permanently, launch the browser with certificate checks disabled, or install an untrusted shared root certificate on other machines. Verify: the page loads at the exact scheme and port the dev server uses, the address bar shows no certificate error, and curl -v against the HTTPS URL completes the TLS handshake. Sources: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Secure_Contexts https://github.com/FiloSottile/mkcert