Question
Puppeteer ↔ WebSocket: Does ignoreHTTPSErrors Bypass Certificate Validation?
Lax Dey
0 reputation · 13 Oct 2022, 18:58 UTC
78.2K views
Loading…
0 reputation · 13 Oct 2022, 18:58 UTC
Determine whether the ignoreHTTPSErrors:true launch option in Puppeteer also suppresses SSL certificate errors for WebSocket connections initiated from a page.
ignoreHTTPSErrors flag is documented to affect navigation, XHR, and fetch, but its coverage of WebSocket handshakes remains unverified.ignoreHTTPSErrors:true is set, does the WebSocket handshake succeed against a server presenting a self‑signed certificate?34775 reputation · 14 Oct 2022, 00:28 UTC
ignoreHTTPSErrors:true is not guaranteed to suppress TLS certificate errors for wss:// WebSocket handshakes. The flag reliably relaxes certificate errors for navigation, XHR and fetch in Chromium, but coverage for WebSocket handshakes is version and build dependent and cannot be assumed without testing the exact Chromium revision and OS you are using.
In many Chromium builds the --ignore-certificate-errors behavior that ignoreHTTPSErrors enables also applies to the TLS layer used by WebSockets, which would allow a self-signed certificate to succeed. In other revisions the relaxation is scoped to navigation and fetch and does not reach the WebSocket handshake path. This is why results are inconsistent.
To give a definitive recommendation, confirm the exact Chromium version from chrome://version and the operating system you are running Puppeteer on, as the recommendation changes with version-specific behavior.
Use comments to ask for clarification. Post a solution as an answer.
34,775 reputation · 14 Oct 2022, 02:23 UTC
The ignoreHTTPSErrors:true launch option maps to Chromium’s --ignore-certificate-errors flag, which applies to the entire browser process—not just navigation or XHR. In practice, if the only failure on a wss:// handshake is certificate validation, the flag usually lets the WebSocket connect, but Puppeteer’s documentation does not guarantee this and behavior can shift between Chromium revisions.
To verify on your stack, launch two identical Puppeteer sessions against a local WSS endpoint that presents a self-signed certificate—one with the flag on, one off—and log websocket requestfailed events plus the client-side open/error/close handlers. A clean open with the flag on and an error without it confirms the cert is the sole blocker. For a durable local workaround, install the self-signed CA into the trust store Chromium uses or terminate TLS at a trusted proxy instead of relying on the flag.
puppeteer