Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was called "server" which I heard can cause problems (didn't have any though for about 6 years).
So in my openssl cnf file I've set following alt names:
[ alt_names ]
DNS.1 = server.nordprim.local
DNS.2 = *.server.nordprim.local
DNS.3 = server
DNS.4 = *.server
DNS.5 = nrv01.nordprim.local
DNS.6 = *.nrv01.nordprim.local
DNS.7 = nrv01
DNS.8 = *.nrv01
IP.1 = 192.168.10.254
I kept the old name for now so I can update hosts first to use the new name.
And here's my problem. Whenever I try to access nrv01 or nrv01.nordprim.local with Firefox it would throw SSL_ERROR_BAD_CERT_DOMAIN error but "server", "server.nordprim.local" and the ip address works just fine. Chromium doesn't have that problem.
Here's error description (in polish but it confirms that the new certificate is loaded):
Witryny potwierdzają swoją tożsamość poprzez certyfikaty. Firefox nie ufa certyfikatowi witryny „nrv01”, ponieważ nie jest on dla niej prawidłowy. Certyfikat został wystawiony tylko dla następujących domen: server.nordprim.local, *.server.nordprim.local, server, *.server, nrv01.nordprim.local, *.nrv01.nordprim.local, nrv01, *.nrv01, 192.168.10.254
Clearing cookies, cache and offline data did not help. Even creating new profile did not help.
Any idea what may cause the problem? Perhaps Firefox can't handle that many DNS alt names?
Also, I have set CN to nrv01.nordprim.local
EDIT: Here's the certificate that I have been asked for:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4105 (0x1009)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = PL, ST = pomorskie, O = Nordprim Sp. z o.o., OU = Nordprim Sp. z o.o., CN = Nordprim Sp. z o.o., emailAddress = [email protected]
Validity
Not Before: Feb 3 07:21:33 2020 GMT
Not After : Feb 12 07:21:33 2021 GMT
Subject: C = PL, ST = pomorskie, L = Przyjazn, O = Nordprim Sp. z o.o., CN = nrv01.nordprim.local, emailAddress = [email protected]
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ce:d6:c4:f6:b6:ae:22:23:33:8f:7b:b4:58:4f:
0d:09:b8:8d:67:06:5d:13:b2:e4:c4:b2:30:6e:35:
98:f7:45:aa:c4:47:dd:5b:75:08:7c:e0:44:68:4e:
33:08:c9:46:35:92:40:20:ac:b6:b5:f2:f1:1f:f0:
ce:b0:d2:b5:2b:b3:dc:20:86:cb:57:25:1e:7e:76:
ba:cc:aa:d0:20:39:2e:bc:1c:c1:72:24:6b:75:2b:
e3:29:24:7d:9c:37:3a:2d:89:d2:56:62:c4:0a:7a:
b6:82:07:d4:5c:7d:62:57:9f:d4:ce:03:40:35:49:
4b:03:fa:1c:da:59:9c:de:7a:ab:c9:4b:d7:09:c6:
2c:88:5d:c1:91:a6:df:b3:66:c6:7d:1c:50:7d:59:
93:91:a9:47:08:8c:89:5c:13:54:1c:8c:25:1a:99:
d1:26:51:cf:0f:13:18:26:a8:b4:3f:f6:9d:d6:41:
d4:28:49:15:36:2c:06:7c:84:1e:97:98:46:d8:bc:
0b:eb:7c:73:6c:e7:72:f5:59:5a:a0:0d:c8:cc:47:
0d:74:e4:64:6f:15:96:fb:54:ae:6e:e8:9a:06:74:
5a:63:28:3a:d3:35:4f:8d:e7:bb:5e:bf:d5:5d:0b:
8e:88:16:98:ea:c7:ab:73:8c:d0:bd:ec:65:77:47:
95:3b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
X509v3 Subject Alternative Name:
DNS:server.nordprim.local, DNS:*.server.nordprim.local, DNS:server, DNS:*.server, DNS:nrv01.nordprim.local, DNS:*.nrv01.nordprim.local, DNS:nrv01, DNS:*.nrv01, IP Address:192.168.10.254
Signature Algorithm: sha256WithRSAEncryption
55:61:19:72:8e:1b:d3:f7:aa:e5:42:cf:32:dd:e5:a6:7a:91:
22:7c:bd:d4:b1:f4:52:64:ea:29:56:e7:48:6e:cc:f8:4d:bf:
42:46:41:6a:9c:cc:bf:5e:ef:66:c3:bd:dd:50:13:c8:2c:5a:
bc:a5:cd:95:57:22:c2:e1:e4:e1:35:14:9a:a6:11:b6:ea:77:
c0:92:30:e0:d3:18:c7:14:b7:9b:ae:8f:a5:ab:f5:92:ae:82:
4d:62:0e:7d:7d:3f:c2:3b:e1:6f:c7:27:19:43:df:eb:f1:24:
cc:db:fe:00:72:cd:81:0e:8c:6a:db:42:29:9c:8d:c9:95:39:
5b:52:44:41:e6:19:78:f2:b6:9d:5b:0f:7c:50:23:f9:f7:be:
77:93:30:91:7a:e2:3f:9d:71:a1:47:58:5d:49:21:9a:4f:5a:
96:0b:c6:14:0f:52:fb:eb:ab:bc:74:a9:d0:be:c7:fc:7f:eb:
39:83:2c:b8:b7:ec:77:52:de:18:64:39:75:7b:71:26:d6:ec:
3e:08:7f:fb:3e:39:f0:7a:4c:cf:de:25:ad:19:0d:fe:bb:8d:
a5:7e:6a:e0:65:ee:e1:f9:c2:90:b3:df:43:15:58:80:6c:61:
20:3d:56:fd:7d:aa:b6:8c:e9:29:80:61:fe:61:ab:f4:8c:d5:
8f:b6:1f:11:db:03:24:17:6c:31:19:21:31:60:ce:82:ca:44:
c2:61:ce:11:0d:5d:8e:7c:2d:1f:a8:51:0e:39:19:1e:09:48:
45:03:fe:f0:38:84:dd:d7:4a:c6:71:4f:c4:99:eb:29:bb:e9:
e9:f2:4f:17:4c:ea:6f:e6:64:04:f9:e7:7c:24:ff:cc:2b:bb:
81:18:10:4e:eb:46:e7:7d:52:0e:64:05:74:75:3a:1b:20:7e:
92:11:71:d0:be:45:ac:0f:e3:2a:27:e1:48:42:10:41:16:db:
b5:a9:34:c7:c4:44:bc:0f:66:9f:ae:d2:d6:2b:e8:d1:b0:78:
39:e9:b2:e4:2f:91:0b:2e:e9:36:bb:9a:89:a2:5f:9a:9a:8d:
54:1f:24:b9:e6:4b:2e:8e:13:cb:ac:d3:d1:26:df:3b:95:49:
11:fe:25:4e:17:65:dc:ff:83:38:aa:60:0f:b2:b7:67:68:c9:
e6:89:b1:62:17:09:2b:80:81:d6:da:18:d8:d6:e0:32:cc:ab:
47:91:97:11:2b:e2:f8:45:e2:82:03:1d:26:29:74:e2:77:d5:
a0:94:6a:10:35:70:79:cb:a0:6c:78:02:83:5c:8f:c4:bb:5f:
60:b3:39:35:bf:fa:58:28:95:51:21:f4:a7:47:87:ea:20:57:
94:8e:71:4b:76:96:84:99