Disable Single Sign on in Chrome

Question

At the large company I work at, we use "Single Sign On" certificates that automatically log us into all Web Applications. Technically, this works through a "Personal Certificate" that I can see when I manage the certificates in the advanced options.

How can I temporarily disable these certificates, or better yet, how can I start Chrome such that it ignores all personal certificates?

Solution

I found the following workaround that persists the "helpful" repair scripts that our I.T. department let's run every few hours... Unfortunately, it disable the certificate system-wide and not just in Chrome, but it is easy to do and undo.

• open certmgr.msc
• navigate to Personal -> Certificate
• double click on the certificate in question
• under the "Details" Tab, click on "Edit Properties", then "Disable All Purposes for this Certificate"

To enable the certificate again, repeat the procedure but click on "Enable All Purposes for this Certificate".

Comments

[Ramhound]

Since Chrome (by default) will trust any certificate in the OS certificate store on Windows, it is going to be difficult to accomplish this, with Chrome. Since you would have to manually, add the certificate to the Firefox certificate store, this is easily done with Firefox. What problem are you trying to accomplish by ignoring the certificate in question? I assume this certificate is loaded with a Smart Card (PIV Certificate)? You might be able to use Manage certificates and indicate the certificates are not trusted. Of course this will make it so the SSO does not work at all(chrome)

[Martin J.H.]

The certificate is not loaded with a Smart Card. But if I somehow manage to cobble together a semi-automated solution that temporarily disables the certificate in Chrome, that would work, too.

[Ramhound]

So have you tried to make the certificate untrusted?

[Martin J.H.]

That is a good idea! So far I tried deleting it, but some watchdog powershell script immediately adds it again... sigh. It would be much easier if there were a command-line option of chrome to ignore the certificate store... The solution described here strangely only works for a few minutes.

[Ramhound]

If the PIV certificate isn't being loaded by a Smart Code, what is handling the certificate, if you explain more about the PIV I could answer this question. Your linked solution is only for IE11, I thought you were using Chrome?