Block Certificate Error Overrides in Edge (Windows 10)

This guide shows you how to stop users from bypassing security warnings in Microsoft Edge on Windows 10. By enforcing this policy, you ensure that when Edge encounters an invalid or untrusted SSL/TLS certificate, users cannot click through the warning and continue to the site. This is a common requirement for managed devices in schools and businesses, and it’s done through the Windows Registry or Group Policy.

What You’ll Need

• Windows 10 Pro, Enterprise, or Education edition (Group Policy Editor is not available on Home).
• Administrator rights on the computer.
• Microsoft Edge (the new Chromium-based version, version 77 or later).

Step-by-Step

1. Open the Group Policy Editor (if available): Press Win + R, type gpedit.msc, and press Enter. If you get an error, use the Registry method below.
2. Navigate to the Edge policy folder: In the left pane, go to Computer Configuration > Administrative Templates > Microsoft Edge > Content settings.
3. Find the policy: In the right pane, double-click Prevent bypassing Edge security warnings.
4. Enable the policy: Select Enabled, then click OK.
5. Apply the change: Close the Group Policy Editor. The policy takes effect immediately, but you can force a refresh by running gpupdate /force in an elevated Command Prompt.
6. For Windows 10 Home or if you prefer Registry: Press Win + R, type regedit, and press Enter.
7. Navigate to the Edge key: Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge. If the Edge key does not exist, right-click on Microsoft, select New > Key, and name it Edge.
8. Create the DWORD value: Right-click in the right pane, select New > DWORD (32-bit) Value, and name it PreventCertErrorOverrides.
9. Set the value: Double-click the new value, set Value data to 1, and click OK.
10. Restart Edge: Close all Edge windows and reopen it. The policy is now active.

Common Mistakes

• Using the wrong registry path: The policy only works under HKEY_LOCAL_MACHINE (machine-wide) or HKEY_CURRENT_USER (per-user). Putting it in the wrong location like HKEY_CURRENT_USER\Software\Microsoft\Edge (without Policies) will have no effect.
• Setting the value to 0: A value of 0 or leaving it unset allows users to bypass warnings. You must set it to 1 to block overrides.
• Forgetting to restart Edge: The policy is read at browser startup. If Edge is already running, the change may not apply until you fully close and reopen it.
• Using Group Policy on Windows Home: The Group Policy Editor is not included in Windows 10 Home. Use the Registry method instead.
• Confusing with other policies: There is a separate policy called “Allow insecure content” or “Allow certificates from non-trusted sources” – make sure you’re editing the correct one.

Tips

• Test the policy: After applying, visit a site with an invalid certificate (e.g., https://self-signed.badssl.com). You should see a warning page with no “Proceed to site” link.
• Deploy via domain: For multiple computers, use Group Policy Management on a domain controller to push the policy to all machines at once.
• Use the Edge policy template: If you manage many devices, download the Microsoft Edge administrative template (ADMX) and load it into Group Policy for a cleaner setup.
• Per-user vs machine-wide: The registry key under HKEY_CURRENT_USER applies only to that user; under HKEY_LOCAL_MACHINE it applies to all users on the device.
• Check the policy status: In Edge, go to edge://policy to see if the policy is recognized and its value.

Troubleshooting

• Policy not working: Verify the registry path is exactly HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge and the value name is PreventCertErrorOverrides (case-sensitive). Also confirm the value is 1 (DWORD).
• Edge still allows bypass: Make sure you are using the stable version of Edge, not a beta or dev channel that might have different policy names. Also, check that no other policy (like a user-level policy) is overriding the machine policy.
• Group Policy shows “Not Configured”: If you set the policy but it appears as “Not Configured” in gpresult, you may not have the Edge ADMX files loaded. Download and install them, then re-apply.
• Can’t find the policy in gpedit: The policy name may be localized in non-English Windows. Look for “Prevent bypassing Edge security warnings” or use the registry method which is language-independent.
• Policy applies but users can still click through: Some sites use HTTP instead of HTTPS, which is not affected by this policy. This policy only blocks bypassing certificate errors, not mixed content or HTTP pages.

Frequently Asked Questions

Does this policy block all certificate errors?

Yes, it prevents users from clicking through any invalid certificate warning, including expired, untrusted, or mismatched certificates. The user will see the warning but no option to continue.

Can users still visit sites with valid certificates?

Absolutely. The policy only affects sites that trigger a certificate error. Valid, trusted certificates work normally.

Will this affect other browsers like Chrome or Firefox?

No, this policy is specific to Microsoft Edge. Chrome has a similar policy (EnableCommonNameFallbackForLocalAnchors, but not exactly the same), and Firefox uses its own settings.

How do I undo the policy?

Set the registry value to 0 or delete the PreventCertErrorOverrides value. In Group Policy, set the policy to “Not Configured” or “Disabled”. Then restart Edge.

Does this work on Edge for macOS?

This guide is for Windows 10. On macOS, you would use a configuration profile (plist) with the same key name, but the steps differ.

Is there a way to allow bypass for specific sites only?

No, this policy is all-or-nothing. If you need to allow certain sites, you would need to install their certificates as trusted root certificates instead of bypassing errors.

Related

• iPhone Stuck in Guided Access? Fix It Now
• Fix Laptop Stuck on Hibernating: Step-by-Step Guide
• Default Apps & Programs Missing on Windows? Fix It