0

Following the previous question, I still have a problem with SSL certificates and my firefox browser believes that the connection is not secure.


Creation of certificate

I have created a certificate by

All the passwords: arnsihtVrrlprephcikrdta23p14351

$ openssl genrsa -des3 -out server.key 1024
Generating RSA private key, 1024 bit long modulus
.......++++++
........................++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:
Verifying - Enter pass phrase for server.key:


$ openssl req -new -key server.key -out server.csr
Enter pass phrase for server.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [Some-State]:VIC
Locality Name (eg, city) []:Melbourne
Organization Name (eg, company) [Internet Widgits Pty Ltd]:myOrg
Organizational Unit Name (eg, section) []:mySection
Common Name (e.g. server FQDN or YOUR name) []:localhost:8080
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:challengeme28392r
An optional company name []:


$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
Signature ok
subject=/C=AU/ST=VIC/L=Melbourne/O=myOrg/OU=mySection/CN=localhost:8080
Getting Private key
Enter pass phrase for server.key:
$ 

And then, I created a PKCS#12 to import it from firefox:

Export Password: aorsta226krstafSRsurerf234

$ openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12
Enter pass phrase for server.key:
Enter Export Password:
Verifying - Enter Export Password:

The output file:

server.key

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,A686CC0FC0CEDE40

CSFKjG7f4sqqDeH4/E35V2KvksV8Wfs7dhFZMK6woKH6udjTmTIuOTQhykzYHAAb
8+yd9nRp7KnPCSXwQR0AMERl7KVFnRwWkCtVLXNuDZOhsXFb9+KdjMxDufiQcE4C
0KUYFwYtQythzlnX0DdHjKFhC7K2mjlykCa8d6pHtrcWnckcrvv4M91glf6vsBnM
7XH5gk7oQXp5PdKGMrlDwvq01NejkLFGc7is1J4Rf+FRWVraFZi2nek+dHjBoF9u
WdAnZpndUorl8vFy2adaUbXTjCfaJ/bsjBNJDxmYIkWiDp8yA49aH1WiG/tY4hm9
znL+Li4M0AZw67ZfcS43NgN7aqx/T9aDdkTlwOAdeR6Gz/zroGzeueC/iyM+Xfxv
LGCfpMVXdWDF4VCQvG4v81oGOiDAmY1HnEwQZUEyhbKBQEDcJ/H/ltQe+B+60Hr9
9fktWkiaTAxnIN/Siut0vb8wDqvrUwrUpo4KTJ+3aZfYNqLMZEm+xy0uE3VqFRcH
b3+Ro89JKyHPzI2maqmDGLeVoQhiDk9uwl0LHz1ujtP1vr6AKFX+LoVu3FFW6aqm
tdyJRuiWarv4ATw6GIh0tGISvO0qq+SZY+ePkeq5x+j5XkknIImIUsoa8jdLZhB/
25ehI6DFBjNeMBEG54XTCr7TX8v+4fbh5tFTjlMiOSatVaPCK1a+1WIBCVUlCJhf
kNE9oE8M6y8IilEWH4y1NWSxodedxeeVs61d66SkzsjHHytH32ss5FWgK6NxMsGP
f0u3PvqQdWoFnFD0GbBUGjk9dAXEgQ+ECyYNkSs/c7fNsRZT34nAIA==
-----END RSA PRIVATE KEY-----

server.crt

-----BEGIN CERTIFICATE-----
MIICTzCCAbgCCQDvxJy2eiwRxzANBgkqhkiG9w0BAQsFADBsMQswCQYDVQQGEwJB
VTEMMAoGA1UECAwDVklDMRIwEAYDVQQHDAlNZWxib3VybmUxDjAMBgNVBAoMBW15
T3JnMRIwEAYDVQQLDAlteVNlY3Rpb24xFzAVBgNVBAMMDmxvY2FsaG9zdDo4MDgw
MB4XDTE3MDcwMjAwMDgzMloXDTE4MDcwMjAwMDgzMlowbDELMAkGA1UEBhMCQVUx
DDAKBgNVBAgMA1ZJQzESMBAGA1UEBwwJTWVsYm91cm5lMQ4wDAYDVQQKDAVteU9y
ZzESMBAGA1UECwwJbXlTZWN0aW9uMRcwFQYDVQQDDA5sb2NhbGhvc3Q6ODA4MDCB
nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3kZDwzFBf1lg16OeicHuSX/Ehj3g
26amjqDWU+6klbHKEzFgjIKnCDesgMYwe6XA246JWmQMcNW/9RYoRi48UXX2clTZ
rpOPrqZzkwpsb+weyHgRHcyR6rmWJX75rmxhk9vMX8Av8zZ4/7xAzEONON61S5W/
qQNHsp+psPltAusCAwEAATANBgkqhkiG9w0BAQsFAAOBgQDZzQMqStn5sOLhyaGW
ptSn9Qk3o5l8CYXrz3Dw0k+0LmgiZ7ottWY7mE6X3e8N1iJDwtsTUVcPyw6SBPCh
qxFkeputxUu/mEzHnXsTEMFHr+qJOgviGt6iO2+uN3r1msydiQi4V97SPoMBvR3z
pheRB6QBNKSCv6O8On0H06cOLw==
-----END CERTIFICATE-----

server.p12

3082 0649 0201 0330 8206 0f06 092a 8648
86f7 0d01 0701 a082 0600 0482 05fc 3082
05f8 3082 02f7 0609 2a86 4886 f70d 0107
06a0 8202 e830 8202 e402 0100 3082 02dd
0609 2a86 4886 f70d 0107 0130 1c06 0a2a
8648 86f7 0d01 0c01 0630 0e04 086e 3b7f
e774 616b 6702 0208 0080 8202 b0e1 1a84
261e 2e2b 1ab0 6c7f f43f d572 d794 0517
7a95 1e6d b07d ee01 e042 b45d b876 9591
35cb 1d57 fb78 4a4a f8f8 c6f8 5aa4 a82c
0fba c5f2 8609 426a 709f aeeb 0808 e3e7
a4a8 565c 96b0 91f6 e4d3 0c23 3524 71ae
352f cfe8 fb9d b95f 11a1 131a 404e 5c5b
bd0b 13f9 7b4a 235e ae94 d4f4 53d4 5034
f6a0 a730 2020 f222 ab08 b5c7 f8d3 15a8
cad0 0943 50b5 d84f c9b2 ad45 b31b 234c
85c9 152c 5856 f8a7 f203 3e9f 6311 e537
1149 676c 5448 a4d5 3ca7 305b afd4 fa43
1ee4 4b49 339f 405b c494 1e0e 02ff c28f
2ad7 284e 99f9 f051 f809 f4f7 6a7c fa40
6fef ebe4 8f92 f860 9b90 3a01 3ffa 9bd5
772a 3ef6 c3b3 d7f4 0970 0591 6664 e30b
3a25 76ad cdf7 41f5 9d21 8a44 5a68 4d0f
2fe4 7285 fde8 0034 42e8 52b9 1a02 0640
ab8e 6385 d9f8 b937 b592 48ba c443 9040
6fb1 86ab b850 2ac3 dfce 6665 4f13 8e22
17c2 fbc5 bdaf 72fc 522c 9d16 999b ae76
3290 e778 6459 1c13 f846 55dc 3539 113e
effd e79a e07f 9318 821f 5cc8 4e95 cd4f
e9f9 4dd1 e786 e8d0 2c72 8226 bb8e b5d8
ffd9 5f13 47cc db6d 4c3b efe0 4bc5 3eb6
22fe 3019 94d2 7460 e6df f084 a2ef 87ae
9062 4622 bf72 928d e80d e56b 5f7e 54ed
6760 8de6 2448 28cb 69f4 1764 b1b8 b846
10e7 1e64 e1fc f1d7 ae47 024c 9c7d 0a89
ddb8 62c4 6dc5 2597 eea9 b8a9 3efa bc70
b325 b39d df51 dcb9 357d 6ff9 3286 961d
37c8 b6cd e6de da50 f6a0 49f9 81f6 2ed5
893e 4771 610a 6ca7 54ac 5d1f 46a0 2a9b
a4f5 86c2 3e59 79a0 c4c0 eef6 00de 77de
fb89 95f3 2551 bf10 2cb4 6a49 f0ce ab55
d4b4 18a8 03c2 96bd 1c0b 0c7d e78f 033e
951e 6e00 c43b bd7f f1c1 5dfb d460 582c
459d e0a0 a5b5 8342 826d 70fc 8526 214a
4cb0 923f 0a53 1cd0 f279 170d b6be 35d5
da13 5d86 02fc a154 f0a7 7c40 64ee 8f9d
41be cf1d fb76 df63 d80a 066c a833 04c2
9211 c2de a949 a26a d45c 35c5 4a35 21a0
cba3 7a3b 4d1e ebe9 b2f4 2223 3d89 1606
d7c4 8339 fee8 7cde c4ad 95c2 8130 8202
f906 092a 8648 86f7 0d01 0701 a082 02ea
0482 02e6 3082 02e2 3082 02de 060b 2a86
4886 f70d 010c 0a01 02a0 8202 a630 8202
a230 1c06 0a2a 8648 86f7 0d01 0c01 0330
0e04 083f 34ee e00b b9ed fd02 0208 0004
8202 80a3 5544 cccf 2bfd c353 fc40 afe5
ecf4 1ee6 8d29 25a7 2761 c2c1 5caf ce63
32aa 1c9d cfeb 86a8 84fc 2639 a5c8 33e3
7f3c d51c 9e54 10bf 7d22 450d a49d ac3e
c3eb ee3e ec21 07b3 7444 2430 339f 919a
fb76 134f ea3d f610 9269 19c2 70a4 2f4d
3263 29b0 5293 8544 956a 30c0 3e1c 72f6
a033 9658 c831 1d58 71a8 f9fa 71e4 0f3e
8d29 6436 5bc2 177c ddba c619 cf1f 4968
b5a9 40bb 15f3 f856 1c44 dadf 1905 88d1
38e3 dba5 dc56 d0ae 3812 05c4 2233 a146
3477 d5c9 eec0 7ac2 bedd e230 4306 f2ea
59d6 e2c9 ecd8 b34f f31b 0ba4 0fa3 17f9
7930 cbdd 0aec 3ad4 c089 0f3b cc9c af47
18e6 8e2b dd1c d160 09c5 4b01 520e d662
23cb f6de 84a7 98c7 0613 3305 462f a96a
9a0e a38a d14b d58a f290 973c f4d8 c091
8440 3209 a18e dd1b 7afb 3ab3 8897 6663
f10c 0883 5771 bbe2 b814 0136 00a7 ecd6
9505 db41 d19b 4211 84cd cb9e dc0d f248
318e 911f 6b18 56f2 9092 602d 9989 0661
f5de 6686 9d9f feb9 4fe2 e960 88b5 722e
6cc6 af1b 7c56 6e1c de00 132a b464 65dc
1fee 23e3 06b9 a046 0026 08ba c513 4d6d
c9dd 7308 8cce 2287 b22c 5b00 88a2 36b1
f4b8 a839 30a4 50a5 7a05 9362 c841 c7fa
c184 e436 071d ffd1 d022 5016 b83b 6e17
4e05 20eb 43e0 9aac bc2d 8eb7 be20 1893
9f21 945e 061f 8966 128d 0b65 d83a d2e7
7708 143f 5cd9 0a47 dcfc 8084 a921 2f7f
a0e9 74d8 9f96 03ab b0e8 e5cf 60a0 7473
6103 04e6 ac54 1856 9537 0da3 0147 e992
5a98 6ff0 a53f 50ff 09d6 119c c633 dd18
3921 b6c4 253e b53e d85d 7883 c24a bffe
deb3 b072 dc0f c7e8 df05 dd90 8424 d4c9
e02f ccfa 5eca 80aa 8df5 b0b4 8a47 0926
c53b cde3 2d8c 11ad ddd1 f12c 6cd2 d36c
2621 93d3 8695 c7af 5f9c c003 fa06 3cf7
ca3b 2f38 b2df c08c 38fc 87a6 4d85 67fb
19ec 949f a41e a2c0 17a2 c97a 34fb c504
e222 ec31 2530 2306 092a 8648 86f7 0d01
0915 3116 0414 62b5 1783 2f3b bb33 d423
afc7 f2df 326c 5db9 959b 3031 3021 3009
0605 2b0e 0302 1a05 0004 14c1 5ae0 1116
ce4c 5303 b95b 31cd f433 4447 5839 d904
0837 b3b7 6dcb ef21 2a02 0208 00

Import certificate to firefox

In firefox, I have imported server.p12 as your certificate which asked me a password (Export Password: aorsta226krstafSRsurerf234).

The certificate is imported successfully.


C++ server

I compiled and run Simple-Web-Server,

$ make 

It even asks me the password:

./https_examples
Enter PEM pass phrase:

which I entered (pass=arnsihtVrrlprephcikrdta23p14351).


Loading the page

I loaded:

https://localhost:8080/

And see the message:

Your connection is not secure

and

The owner of localhost has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website

When I add the exception I can load the page with a security warning sign on top.


Wireshark

I capture port 8080. The data seems to be encrypted:

enter image description here


What is wrong?

My question is what is wrong?

What is the next step to check?

1

The reason Firefox is complaining is because it's a self-signed cert. Self-signed certs are inherently insecure in that you cannot verify that the server is who or what it claims, see this previous question for a longer explanation of why. It does not mean the data is not encrypted - it is.

Also, you should be using 2048 bit RSA, not 1024. 1024 is no longer considered secure ("Our results are yet another reminder that 1024-bit primes should be considered insecure for the security of cryptosystems based on the hardness of discrete logarithms", see this paper).

  • Thanks a lot. Beside using 2048 bit RSA, is there any way to get around this problem? – ar2015 Jul 2 '17 at 1:47
  • @ar2015 Getting your certificate signed by a legitimate ca is probably the obvious thing to do. – Luke Park Jul 2 '17 at 2:01
  • @LukePark, where to request? – ar2015 Jul 2 '17 at 2:03
  • @ar2015 There are lots of providers? Just Google search for ssl certificates. – Luke Park Jul 2 '17 at 2:24
3

Getting a certificate from a 'real' CA (an established one Firefox trusts by default) is certainly the best approach, but that requires you use (and have) a public domain name. Firefox can be gotten to trust a cert you sign yourself, including as here one you sign with its own key and name (called selfsigned).

For Firefox to trust a cert identifying a server, the cert must be signed (possibly via a chain) by a cert in the 'Authorities' tab NOT the 'Your Certificates' tab, which is for certs and keys that authenticate the browser (and the browser user). In the case of a selfsigned cert, the 'CA cert' is actually the cert itself. You should delete the entry in 'Your Certificates' and import the cert only (NOT the p12) to 'Authorities' with trust setting 'can identify websites'.

Additional notes:

  • Advice to set only the CommonName in Subject to identify an SSL/TLS server cert is years out of date. The SubjectAlternativeName extension, usually abbreviated SAN and often referenced by other names like multidomain and UCC, was introduced over a decade ago to allow greater flexibility, and in the slow march of progress, Chrome just a few months ago started requring SAN (and rejecting certs that use CN only); Firefox is expected to follow suit.

Unfortunately doing SAN with openssl x509 -req is a bit inconvenient; there are numerous Qs on several Stacks already about it. The simplest alternative is to replace the unnecessarily complicated approach (you copied per your previous Q) with a single openssl command to generate the key AND cert together:

     openssl req -newkey rsa:2048 -keyout server.key -x509 -days 365 -out server.crt 
     # and enter the Subject fields interactively, or add -subj with value per the man page
     # can adjust -days as desired, add -nodes if you want privatekey unencrypted 
     # if openssl version below 1.0.2 preferably add -sha256
     # although browsers _probably_ ignore this as the selfsignature 
     # is only needed to fit the standard format and not for security

but first edit your config file -- or usually better edit a copy of it and specify that copy with -config filename -- adding in the x509_extensions section a line subjectAltName=DNS:yourdomainname. If you don't know where your default config file is, check if envvar OPENSSL_CONF or OPENSSLDIR is set and if not look at openssl version -d for openssl.conf.

  • For both CommonName and SAN, the server domainname in the cert should NOT include :port as you have in your Q. Although :port is sometimes part of a URL, it is not part of a domainname, or for that matter of an IP address.
  • Thanks a lot for your comprehensive answer. Following your advice, I have deleted the p12 from Your Certificates and added sevice.crt in Authorities. I still face with the warning message "Your connection is not secure". Should I fix SAN for now? or is there something else that I should check? – ar2015 Jul 2 '17 at 9:43
  • Firefox isn't enforcing SAN yet at least not the one I have (53), although it wouldn't hurt to prepare. But did you change the name in the cert to localhost and not localhost:8080 as I said? If so, what does the Advanced button on the FF error page show? – dave_thompson_085 Jul 3 '17 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.