Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft Edge blocks Web Authentication (WebAuthn) when a website presents a TLS certificate error. The policy Allow Web Authentication requests on sites with broken TLS certificates (AllowWebAuthnWithBrokenTlsCerts) changes that behavior globally for the Edge profile: Enabled permits the request, while Disabled or Not configured keeps the default block. Microsoft recommends repairing the certificate rather than weakening this safeguard; use an enabled policy only as a documented, tightly scoped exception.
What this Edge policy controls
Web Authentication, usually called WebAuthn, is the browser API used for passkeys, FIDO2 security keys, Windows Hello, platform biometrics and other public-key authenticators. This policy does not enable or disable WebAuthn generally. It only determines whether a Web Authentication ceremony may proceed when Edge has detected a TLS certificate error on the site.
As an Amazon Associate I earn from qualifying purchases.
Microsoft documents the policy and its security warning at the Edge policy reference.
Policy values
| Policy state | Result |
|---|---|
| Enabled | Allows Web Authentication requests on sites with TLS certificate errors. |
| Disabled | Blocks those Web Authentication requests. |
| Not configured | Uses Edge’s default behavior, which blocks them. |
| Recommended policy | Not available; this is a mandatory-only Boolean policy. |
The setting is not a website allowlist. It accepts no domain or URL list, so enabling it affects every applicable site in that Edge profile. If one internal service needs an exception, fix that service’s certificate first or assign the exception to the smallest practical user or device group for the shortest practical time.
#1 Best Overall
- Microsoft Surface Laptop Go 2 | Certified Refurbished, Amazon Renewed | 12.4-inch (1536 x 1024) LCD Touchscreen Display | Windows 11 Professional | Platinum Silver Color
- This Certified Refurbished product is tested and certified to look and work like new. The refurbishing process includes functionality testing, basic cleaning, inspection, and repackaging. The product ships with all relevant accessories, a minimum 90-day warranty, and may arrive in a generic box.
- 256GB Solid State Drive, 16GB RAM, Intel Core i5-1135G7 CPU, Convenient security with Windows Hello sign-in, plus Fingerprint Power Button with Windows Hello and One Touch sign-in on select models., Integrated Intel UHD Graphics
- Bluetooth, Wi-Fi: 802.11ax Wireless LAN, Run your favorite apps and keep up on social media with a 11th Gen Intel Core Processor.
What counts as a broken TLS certificate?
Edge can report a certificate problem for an expired certificate, a hostname mismatch, an untrusted or incomplete chain, a self-signed certificate, a certificate issued by a private CA that the device does not trust, or a TLS-inspection certificate missing from the client’s trust store. An incorrect system clock can also make an otherwise valid certificate fail validation.
The policy does not repair any of these conditions. Allowing WebAuthn merely permits authentication while the browser still considers the connection unsafe. WebAuthn credentials are origin-bound, but bypassing certificate-error blocking weakens an important transport and origin-security control and can expose users to interception or misconfiguration. The Web platform’s certificate-error rationale is described by the W3C specification.
Supported Edge versions and platforms
Microsoft’s current policy documentation lists support for:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Windows: Edge 123 or later
- macOS: Edge 123 or later
- Android: Edge 138 or later
- iOS: not supported for this policy
Version support can change with future Edge releases. Check the installed browser at edge://settings/help before troubleshooting delivery.
Rank #2
- Microsoft Surface Laptop Go | Certified Refurbished, Amazon Renewed | 12.4-inch (1536 x 1024) LCD Touchscreen Display | Windows 10 Professional
- This Certified Refurbished product is tested and certified to look and work like new. The refurbishing process includes functionality testing, basic cleaning, inspection, and repackaging. The product ships with all relevant accessories, a minimum 90-day warranty, and may arrive in a generic box.
- 256GB Solid State Drive, 16GB RAM, Intel Core i5-1035G1 CPU, Convenient security with Windows Hello sign-in, plus Fingerprint Power Button with Windows Hello and One Touch sign-in on select models., Integrated Intel UHD Graphics
- Bluetooth, Wi-Fi: 802.11ac Wireless LAN, Run your favorite apps and keep up on social media with a 10th Gen Intel Core Processor.
Configure it in the Microsoft 365 Edge management service
The Edge management service is a dedicated experience in the Microsoft 365 admin center. Microsoft documents its configuration and assignment model at Microsoft Edge management service documentation. The service assigns policies to Microsoft Entra groups and resolves conflicting cloud policies by priority; priority 0 is highest. Microsoft states that this service is unavailable to GCC customers.
- Sign in to the Microsoft 365 admin center with an account that can manage Edge policies.
- Open Settings, select Microsoft Edge, then open Configuration policies.
- Select Create policy and give it a descriptive name, such as
Edge - Block WebAuthn on Broken TLS. - Document the reason, affected group, whether the change is temporary, an owner and a review or removal date.
- Choose the available platform and policy scope, then add Allow Web Authentication requests on sites with broken TLS certificates. If shown, confirm the identifier
AllowWebAuthnWithBrokenTlsCerts. - Set Disabled for the safer default. Select Enabled only for a controlled exception whose certificate problem is understood and approved.
- Review More details, skip extension configuration unless needed, and assign the policy to a narrowly defined Microsoft Entra group.
- Review the configuration and assignments, select Review and create (or the equivalent final control), then monitor policy status and client receipt.
Configure it with Intune Settings Catalog
For Intune-managed Windows devices, use the Settings Catalog route described in Intune Settings Catalog documentation and Microsoft’s Edge-with-Intune guidance.
- Sign in to the Intune admin center.
- Go to Devices > Manage devices > Configuration > Create > New policy.
- Select Platform: Windows 10 and later and Profile type: Settings catalog, then name the profile.
- Select Add settings and search for the display name or
AllowWebAuthnWithBrokenTlsCerts. - Configure the Boolean value. Choose Disabled for normal operation or Enabled for a narrowly scoped exception.
- Proceed through scope tags and assignments, targeting the intended Microsoft Entra user or device group.
- Review the profile and select Create. Allow the device to check in before verifying the local policy.
Do not configure the same setting through Intune, Edge cloud policy and Group Policy without understanding precedence. Competing channels can make an apparently correct assignment appear ineffective.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAlternative Windows deployment with administrative templates or registry
Microsoft lists the native Windows policy under Administrative Templates/Microsoft Edge. Its registry location is HKLMSOFTWAREPoliciesMicrosoftEdge, with a REG_DWORD value named AllowWebAuthnWithBrokenTlsCerts. A value of 1 enables the policy and 0 disables it. The policy has no recommended-policy equivalent. See Microsoft’s general Edge policy configuration guidance.
Rank #3
- [This is a Copilot+ PC] — A new AI era begins. Experience enhanced performance and AI capabilities with Copilot+ PC, boosting productivity with security and privacy in mind
- [Introducing Surface Laptop] — Power, speed, and touchscreen versatility with AI features. Transform your work, play, and creativity with a razor-thin display and best-in-class specs.
- [Exceptional Performance] — Surface Laptop delivers faster performance than the MacBook Air M3[1], with blazing NPU speed for seamless productivity and AI apps.
- [All-Day Battery Life] — Up to 20 hours of battery life[6] to focus, create, and play all day.
- [Brilliant 15” Touchscreen Display] — Bright HDR tech, ultra-thin design, and optimized screen space.
For a controlled Windows test, an administrator can run:
New-Item -Path 'HKLM:SOFTWAREPoliciesMicrosoftEdge' -Force | Out-Null
New-ItemProperty `
-Path 'HKLM:SOFTWAREPoliciesMicrosoftEdge' `
-Name 'AllowWebAuthnWithBrokenTlsCerts' `
-PropertyType DWord `
-Value 0 `
-ForceCentral management is preferable to direct registry editing because it provides assignment, auditing and lifecycle control.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify that Edge received the policy
- On the managed client, open
edge://policy. - Search for
AllowWebAuthnWithBrokenTlsCerts. - Confirm that the expected value appears, the source is the intended channel and no conflict or error is shown.
- Select Reload policies when available, then restart Edge if the policy arrived while the browser was running.
Also check edge://settings/help for the supported browser version. In Intune or the Edge management service, verify group membership, recent device check-in, platform targeting, assignment filters and policy priority. A user may have multiple Edge profiles; test the profile that actually received the policy.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Windows Event Viewer can provide supplemental evidence. Search the relevant MDM PolicyManager activity for AllowWebAuthnWithBrokenTlsCerts, but treat event names and message text as environment-dependent rather than a universal exact string.
Rank #4
- With 16 GB of memory, runs as many programs as you want without losing the execution
- The 13.5" 2256 x 1504 screen provides a great movie watching experience
- 512 GB SSD is enough to store your essential documents and files, favorite songs, movies and pictures
- 8 Hours battery run time helps you stay unwired and work longer non-stop
Troubleshoot a missing or ineffective policy
The policy is absent from edge://policy
- Confirm the Edge version and that the platform is supported; iOS cannot apply this policy.
- Confirm the policy was created in the intended service and that the user or device belongs to the assigned group.
- Check enrollment, recent check-in, assignment filters and exclusions.
- Reload policies, restart Edge and test a clean managed profile.
- Inspect for another management channel: GPO, local registry, Intune or Edge cloud policy.
A different value is displayed
Check for overlapping Intune profiles, GPO settings and cloud policies. In the Edge management service, review policy priority because the highest-priority applicable cloud policy wins. Remove ambiguous assignments rather than repeatedly changing the same setting.
The site uses a private CA or TLS inspection
Deploy the correct root and intermediate CA to managed devices, verify hostname and chain configuration, and check that the inspection appliance is trusted and does not interfere with WebAuthn. Enabling this policy is not a substitute for correcting enterprise PKI or proxy trust.
Authentication still fails after the policy is enabled
Confirm that the operation is actually WebAuthn, the browser and authenticator are supported, and the policy appears as enabled. If those checks pass, investigate the site’s JavaScript, relying-party configuration, authenticator policy and the specific certificate error. A password login succeeding does not demonstrate that the certificate is acceptable for WebAuthn.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Security decision: when should it be enabled?
| Choice | Benefit | Risk or cost |
|---|---|---|
| Disabled or not configured | Preserves Edge’s certificate-error protection. | WebAuthn may fail on a legacy or misconfigured internal site. |
| Enabled globally | Restores compatibility quickly. | Allows certificate-error authentication broadly and can normalize unsafe TLS. |
| Enabled for a narrow group | Limits exposure while an exception is investigated. | Still requires approval, monitoring, expiry and removal. |
| Repair the certificate | Preserves the normal security model. | May require PKI, DNS, proxy or application work. |
Keep the policy disabled or unconfigured when the site is public-facing, handles privileged or sensitive data, has an unexplained error, or cannot be monitored. Consider enabling it only when the service is controlled and internal or laboratory use, the certificate problem is documented, a risk owner approves the exception, affected users are narrowly scoped, and the site owner has a remediation plan. Record an owner and review date, monitor use, and remove the policy as soon as the certificate is fixed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
