Hey there! Let's break down your two technical questions with practical, actionable solutions tailored to your setup:

Chrome provides a straightforward way to check if a page is in a secure context, which maps directly to its "Secure" vs "Not Secure" status bar indicator. Here's how to do it:

• Use the window.isSecureContext API: This is the most reliable method, as it returns true only when the page is in a trusted secure context (i.e., Chrome shows "Secure"—valid HTTPS, localhost, etc.). It returns false for both HTTP pages and HTTPS pages with invalid/untrusted certificates (the "Not Secure" cases).
• For more granularity, combine it with location.protocol to distinguish between HTTP and invalid HTTPS:

  function getSiteSecurityStatus() {
    if (window.isSecureContext) {
      return "Secure";
    } else {
      return location.protocol === "http:" 
        ? "Not Secure (HTTP)" 
        : "Not Secure (Invalid HTTPS Certificate)";
    }
  }
  

  Important note: If you're testing an HTTPS site with a bad certificate, Chrome will block the page from loading by default. Your script will only run if the user manually bypasses the security warning (or if your automation framework is configured to ignore SSL certificates, which ties into your second question).

Since you already have a robust unit test framework, adding tests to protect your SSL ignore feature is straightforward—here's how to structure it, including IE-specific adaptations:

2.1 Core Test Cases (Chrome/Firefox/Edge) #

These tests validate that the SSL ignore flag works as expected across modern browsers:

• Positive Test: SSL Ignore Enabled
  1. Configure your framework to enable SSL certificate ignoring (e.g., in Selenium, set acceptInsecureCerts: true in your browser capabilities).
  2. Navigate to a test site with a self-signed or invalid SSL certificate.
  3. Assert that the target page loads successfully: Check for a specific element or page title that confirms you're on the intended site, not a browser security warning page.
• Negative Test: SSL Ignore Disabled
  1. Disable the SSL ignore flag in your framework.
  2. Navigate to the same invalid certificate site.
  3. Assert that the browser displays its native security warning (e.g., Chrome's "Your connection is not private" page; check for unique text or page identifiers).

2.2 IE-Specific Adaptations #

Internet Explorer behaves differently when encountering invalid SSL certificates—it redirects to a dedicated warning page (usually with a URL starting with res://ieframe.dll/sslnav.htm). You'll need dedicated test cases for this:

• IE Positive Test: SSL Ignore Enabled
  1. Configure IE to ignore invalid certificates (in Selenium, set CapabilityType.ACCEPT_INSECURE_CERTS to true, and ensure IE's security settings allow this via registry or browser options if needed).
  2. Navigate to the invalid certificate site.
  3. Assert that you land on the target page, not IE's SSL warning: Verify the URL doesn't contain res://ieframe.dll and that expected page elements are present.
• IE Negative Test: SSL Ignore Disabled
  1. Disable SSL ignore for IE.
  2. Navigate to the invalid certificate site.
  3. Assert that IE redirects to its SSL warning page: Check for the warning URL or text like "There is a problem with this website's security certificate".

2.3 Integrating into Your Build Pipeline #

To prevent broken versions from being deployed:

• Add all these test cases to your CI/CD workflow (e.g., Jenkins, GitHub Actions).
• Set up your pipeline to fail the build if any of these SSL tests fail—this blocks deployment of versions where the SSL ignore feature is broken.
• Use a browser automation grid (like Selenium Grid) or cloud testing service to run tests across Chrome, Firefox, and IE in parallel during each build.

内容的提问来源于stack exchange，提问作者Baaleos