0

I have been happily using self signed certificates for locally hosted sites running on apache2 for a couple of years. Today one of those certificates expired - no biggie, I recreated it and replaced the cert in my keychain. However, Chrome is now giving me an error when I try to visit the site:

Certificate Error
There are issues with the site's certificate chain (net::ERR_CERT_COMMON_NAME_INVALID).

So I thought maybe the cert I had generated was dodgy. But no - all of my other (unexpired) self signed certs have stopped working too! Is it a coincidence? I don't know.

I thought maybe it didn't like my 'common name' (which was com06, e.g. https://com06/) so I tried with com06.dev. No luck!

What is going on?

Certs generated with 

openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 -keyout server.key -out server.crt

Added to keychain with 

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain server.crt
  • macOS 10.11.6
  • Chrome v58.0.3029.33 beta (64-bit)

Self signed certs are accepted by Safari, this is only a problem with Chrome

Update

As of Chrome v58.0.3029.41 beta, I get this helpful error message in the developer tools:

Subject Alternative Name Missing
The certificate for this site does not contain a Subject Alternative 
Name extension containing a domain name or IP address.
Improve this question
2
  • Are you asking if chrome is ratcheting up security and doubling down on trust? Or how to get better carts like using certbot or other sources?
    – bmike ♦
    Commented Mar 25, 2017 at 17:44
  • No, I'm just wondering why my certs stopped working all of a sudden
    – diachedelic
    Commented Mar 25, 2017 at 18:12

2 Answers 2

Reset to default
1

You can temporarily disable the SAN enforcement using the EnableCommonNameFallbackForLocalAnchors policy, see this page for details. This will allow you to reissue your certificates when time allows it.

On OSX this can be achieved using the following command:

defaults write com.google.Chrome EnableCommonNameFallbackForLocalAnchors -bool true
Improve this answer
0

The issue was the missing Subject Alternative Name (SAN), which was not being filled in when I generated my self signed certs using openssl. However, this excellent answer explains how to generate compatible certs using open ssl.

To check if your cert contains an SAN, use openssl x509 -in my.crt -text

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .