I have the "chain" of certificates on a test machine right now:

• A self-signed CA cert, in my Keychain and trusted & trusted by Firefox.

• A CA cert with with the following,

    X509v3 Name Constraints: critical
      Permitted:
        DNS:mydomain.net
        DNS:.mydomain.net
  

• A non-CA cert with signed by the above.

The test webserver serves the latter two certs.

On OS X, Firefox accepts this; Chrome does not. It looks like Chrome just uses whatever the OS uses for crypto purposes, so here, OS X is the issue. Viewing the cert shows:

"This certificate cannot be used (unrecognized critical extension)"

Extension: Name Constraints (2.5.29.30)
 Critical: YES
     Data: <a sequence of octets>

I'm guessing because I'm seeing a sequence of octets, and not a nice decoded view (like I do with other extensions), that this is the extension causing the error.

I can't get it to work on Linux either (and I've not testing FF there yet), but I think this is because I don't understand how to accept my self-signed cert. (I think Chrome should work there, b/c Chrome will use the same library as FF on the "use the OS's crypto" rule)

I have the following "chain" of certificates on a test machine right now:

• A self-signed CA cert, in my Keychain and trusted & trusted by Firefox.

• A CA cert with with the following,

    X509v3 Name Constraints: critical
      Permitted:
        DNS:mydomain.net
        DNS:.mydomain.net
  

• A non-CA cert with signed by the above.

The test webserver serves the latter two certs; the first is marked as "trusted" in Keychain in OS X, in Firefox itself, and on my Linux side, also in FF and by certutil.

On OS X, Firefox accepts the connection as secure; Chrome and Safari do not. It looks like Chrome & Safari just uses whatever the OS uses for crypto purposes, so here, OS X is the issue. Viewing the cert shows:

"This certificate cannot be used (unrecognized critical extension)"

Extension: Name Constraints (2.5.29.30)
 Critical: YES
     Data: <a sequence of octets>

I'm guessing because I'm seeing a sequence of octets, and not a nice decoded view (like I do with other extensions), that this is the extension causing the error.

I can't get it to work on Linux either under Chrome (works fine in FF, again); there, however, it doesn't seem to be able to find the root cert (whereas on OS X it can); I think this is because I don't understand how to accept my self-signed cert. (The Internet says certutil, and I've tried just about every combination of that to no avail.)