Is importing just the CA certificate to Keychain Access enough for trusting certs issued with that CA?

Question

I've created a PKI with easy-rsa. I create keys for websites and sign them with my CA certificate. I imported the CA certificate into Keychain Access, clicked the cert name, and specified "Always Trust".

The websites with keys signed by this CA certificate still cannot be accessed (invalid certificate errors). I tried importing one of the site public keys into Keychain Access also, but I still got the error. Am I missing a step?

Answer 1

Importing and trusting the CA certificate is enough. Make sure your website certificate is really properly signed by the CA, is valid according to the "valid from" and "valid until" dates, and has proper Subject Alternative Names for your server address.

Also be aware that some third-party browsers (Firefox, for example) use their own certificate storage and don't use the macOS keychain. You would need to import your CA certificate into their storage.

Answer 2

Yes, it should be enough.

But see the below constraints (esp. the validity period) which might explain why the certificate is not declared valid on macOS/iOS, although technically it is correct.

### Requirements for trusted certificates in iOS 13 and macOS 10.15

All TLS server certificates must comply with these new security requirements in iOS 13 and macOS 10.15:

• TLS server certificates and issuing CAs using RSA keys must use key sizes greater than or equal to 2048 bits. Certificates using RSA key sizes smaller than 2048 bits are no longer trusted for TLS.
• TLS server certificates and issuing CAs must use a hash algorithm from the SHA-2 family in the signature algorithm. SHA-1 signed certificates are no longer trusted for TLS.
• TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.

Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines:

• TLS server certificates must contain an ExtendedKeyUsage (EKU) extension containing the id-kp-serverAuth OID.
• TLS server certificates must have a validity period of 825 days or fewer (as expressed in the NotBefore and NotAfter fields of the certificate).

Connections to TLS servers violating these new requirements will fail and may cause network failures, apps to fail, and websites to not load in Safari in iOS 13 and macOS 10.15.

Source