caches/caches.go   |  3 +++
 fifos/ensure       |  6 ++++--
 fifos/insecures.go | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 fifos/start.go     |  3 +++
 tls/verify.go      |  5 ++++-

diff --git a/caches/caches.go b/caches/caches.go
index c2f3e2ad138b45b9a0c73ea172eec0728c5f6efec46426cda94c625d6212f58f..35d756e51d6e3de274ddf0707085d0e0da80bd0ff55a045a28f726b027b5472b 100644
--- a/caches/caches.go
+++ b/caches/caches.go
@@ -21,6 +21,9 @@
 	Spies  = make([]string, 0)
 	SpiesM sync.RWMutex
 
+	Insecures  = make(map[string]struct{})
+	InsecuresM sync.RWMutex
+
 	Restricted  = make(map[string][]string)
 	RestrictedM sync.RWMutex
 )
diff --git a/fifos/ensure b/fifos/ensure
index c2a0a58542c880ba614df832e7a6a59385baf5e217e722c3aa39e721f1bebebf..b6767e832edcb652e65eb9544c3001da48937883d07d94fe5f08bd1a028e552d 100755
--- a/fifos/ensure
+++ b/fifos/ensure
@@ -3,10 +3,12 @@
 for f in cert dane err http-auth non-ok ok redir req tls tls-auth various warc ; do
     [ -p log-$f ] || mkfifo log-$f
 done
-for f in accepted http-auth rejected restricted spies tls-auth warcs ; do
+for f in accepted http-auth insecures rejected restricted spies tls-auth warcs ; do
     [ -p list-$f ] || mkfifo list-$f
+done
+for f in accepted http-auth rejected restricted spies tls-auth warcs ; do
     [ -p del-$f ] || mkfifo del-$f
 done
-for f in restricted spies tls-auth warcs ; do
+for f in insecures restricted spies tls-auth warcs ; do
     [ -p add-$f ] || mkfifo add-$f
 done
diff --git a/fifos/insecures.go b/fifos/insecures.go
new file mode 100644
index 0000000000000000000000000000000000000000..79770582fead4ba7d1da27ed6b0597b51d4142cb5a52c0d329367d531a57fef3
--- /dev/null
+++ b/fifos/insecures.go
@@ -0,0 +1,53 @@
+// tofuproxy -- flexible HTTP/HTTPS proxy, TLS terminator, X.509 TOFU
+//              manager, WARC/geminispace browser
+// Copyright (C) 2021-2026 Sergey Matveev <stargrave@stargrave.org>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, version 3 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package fifos
+
+import (
+	"log"
+	"os"
+
+	"go.stargrave.org/tofuproxy/caches"
+)
+
+func listInsecures(p string) {
+	for {
+		fd, err := os.OpenFile(p, os.O_WRONLY|os.O_APPEND, os.FileMode(0o666))
+		if err != nil {
+			log.Fatalln(err)
+		}
+		caches.InsecuresM.RLock()
+		for insecure := range caches.Insecures {
+			if _, err = fd.WriteString(insecure + "\n"); err != nil {
+				break
+			}
+		}
+		caches.InsecuresM.RUnlock()
+		fd.Close()
+	}
+}
+
+func addInsecures(p string) {
+	for {
+		hosts := readLinesFromFIFO(p)
+		caches.InsecuresM.Lock()
+		for _, host := range hosts {
+			log.Printf("%s: adding host %s\n", p, host)
+			caches.Insecures[host] = struct{}{}
+		}
+		caches.InsecuresM.Unlock()
+	}
+}
diff --git a/fifos/start.go b/fifos/start.go
index 83aa875a93340d1b3190e1dda787b829885b07c9b768be66522b2ff0db94532c..6fcc8c66cf03e87503645fedc720489282be3c9ce2e7ae2e0bcf80d6f7389c4a 100644
--- a/fifos/start.go
+++ b/fifos/start.go
@@ -44,6 +44,7 @@ 	go listRestricted(filepath.Join(fifos, "list-restricted"))
 	go listSpies(filepath.Join(fifos, "list-spies"))
 	go listTLSAuth(filepath.Join(fifos, "list-tls-auth"))
 	go listWARCs(filepath.Join(fifos, "list-warcs"))
+	go listInsecures(filepath.Join(fifos, "list-insecures"))
 
 	go del(
 		&caches.AcceptedM, func(host string) { delete(caches.Accepted, host) },
@@ -73,6 +74,8 @@ 			}
 		},
 		filepath.Join(fifos, "del-spies"),
 	)
+
+	go addInsecures(filepath.Join(fifos, "add-insecures"))
 
 	go addWARC(filepath.Join(fifos, "add-warcs"))
 	go del(
diff --git a/tls/verify.go b/tls/verify.go
index 50c1b4ba7b91e89f5456fbb30f360f4226e39cbe7f0372d34b2d792598c3254b..d570488cf83cca64948111464fd212ffd5b0ec188976a58338a37dd39d534887 100644
--- a/tls/verify.go
+++ b/tls/verify.go
@@ -197,6 +197,9 @@ 	caches.RejectedM.RUnlock()
 	if certTheirHash == certOurHash {
 		return ErrRejected{host}
 	}
+	caches.InsecuresM.RLock()
+	_, insecure := caches.Insecures[host]
+	caches.InsecuresM.RUnlock()
 	daneExists, daneMatched := DANE(host, certTheir)
 	if daneExists {
 		if daneMatched {
@@ -232,7 +235,7 @@ HostIsNotRestricted:
 	fn := filepath.Join(Certs, host)
 	certsOur, _, err := ucspi.CertPoolFromFile(fn)
 	if err == nil || dialErr != nil || (daneExists && !daneMatched) {
-		if certsOur != nil && certTheirHash == spkiHash(certsOur[0]) {
+		if (certsOur != nil && certTheirHash == spkiHash(certsOur[0])) || insecure {
 			caches.AcceptedM.Lock()
 			caches.Accepted[host] = certTheirHash
 			caches.AcceptedM.Unlock()