2

Today I've create new certificates for my server (since the old ones were about to expire) using openssl with my own CA. I also used that as an oportunity to change the server's name because it was called "server" which I heard can cause problems (didn't have any though for about 6 years).

So in my openssl cnf file I've set following alt names:

[ alt_names ]
DNS.1 = server.nordprim.local
DNS.2 = *.server.nordprim.local
DNS.3 = server
DNS.4 = *.server
DNS.5 = nrv01.nordprim.local
DNS.6 = *.nrv01.nordprim.local
DNS.7 = nrv01
DNS.8 = *.nrv01
IP.1 = 192.168.10.254

I kept the old name for now so I can update hosts first to use the new name.

And here's my problem. Whenever I try to access nrv01 or nrv01.nordprim.local with Firefox it would throw SSL_ERROR_BAD_CERT_DOMAIN error but "server", "server.nordprim.local" and the ip address works just fine. Chromium doesn't have that problem.

Here's error description (in polish but it confirms that the new certificate is loaded):

Witryny potwierdzają swoją tożsamość poprzez certyfikaty. Firefox nie ufa certyfikatowi witryny „nrv01”, ponieważ nie jest on dla niej prawidłowy. Certyfikat został wystawiony tylko dla następujących domen: server.nordprim.local, *.server.nordprim.local, server, *.server, nrv01.nordprim.local, *.nrv01.nordprim.local, nrv01, *.nrv01, 192.168.10.254

Clearing cookies, cache and offline data did not help. Even creating new profile did not help.

Any idea what may cause the problem? Perhaps Firefox can't handle that many DNS alt names?

Also, I have set CN to nrv01.nordprim.local

EDIT: Here's the certificate that I have been asked for:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4105 (0x1009)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = PL, ST = pomorskie, O = Nordprim Sp. z o.o., OU = Nordprim Sp. z o.o., CN = Nordprim Sp. z o.o., emailAddress = admin@nordprim.eu
        Validity
            Not Before: Feb  3 07:21:33 2020 GMT
            Not After : Feb 12 07:21:33 2021 GMT
        Subject: C = PL, ST = pomorskie, L = Przyjazn, O = Nordprim Sp. z o.o., CN = nrv01.nordprim.local, emailAddress = admin@nordprim.eu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ce:d6:c4:f6:b6:ae:22:23:33:8f:7b:b4:58:4f:
                    0d:09:b8:8d:67:06:5d:13:b2:e4:c4:b2:30:6e:35:
                    98:f7:45:aa:c4:47:dd:5b:75:08:7c:e0:44:68:4e:
                    33:08:c9:46:35:92:40:20:ac:b6:b5:f2:f1:1f:f0:
                    ce:b0:d2:b5:2b:b3:dc:20:86:cb:57:25:1e:7e:76:
                    ba:cc:aa:d0:20:39:2e:bc:1c:c1:72:24:6b:75:2b:
                    e3:29:24:7d:9c:37:3a:2d:89:d2:56:62:c4:0a:7a:
                    b6:82:07:d4:5c:7d:62:57:9f:d4:ce:03:40:35:49:
                    4b:03:fa:1c:da:59:9c:de:7a:ab:c9:4b:d7:09:c6:
                    2c:88:5d:c1:91:a6:df:b3:66:c6:7d:1c:50:7d:59:
                    93:91:a9:47:08:8c:89:5c:13:54:1c:8c:25:1a:99:
                    d1:26:51:cf:0f:13:18:26:a8:b4:3f:f6:9d:d6:41:
                    d4:28:49:15:36:2c:06:7c:84:1e:97:98:46:d8:bc:
                    0b:eb:7c:73:6c:e7:72:f5:59:5a:a0:0d:c8:cc:47:
                    0d:74:e4:64:6f:15:96:fb:54:ae:6e:e8:9a:06:74:
                    5a:63:28:3a:d3:35:4f:8d:e7:bb:5e:bf:d5:5d:0b:
                    8e:88:16:98:ea:c7:ab:73:8c:d0:bd:ec:65:77:47:
                    95:3b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Subject Alternative Name: 
                DNS:server.nordprim.local, DNS:*.server.nordprim.local, DNS:server, DNS:*.server, DNS:nrv01.nordprim.local, DNS:*.nrv01.nordprim.local, DNS:nrv01, DNS:*.nrv01, IP Address:192.168.10.254
    Signature Algorithm: sha256WithRSAEncryption
         55:61:19:72:8e:1b:d3:f7:aa:e5:42:cf:32:dd:e5:a6:7a:91:
         22:7c:bd:d4:b1:f4:52:64:ea:29:56:e7:48:6e:cc:f8:4d:bf:
         42:46:41:6a:9c:cc:bf:5e:ef:66:c3:bd:dd:50:13:c8:2c:5a:
         bc:a5:cd:95:57:22:c2:e1:e4:e1:35:14:9a:a6:11:b6:ea:77:
         c0:92:30:e0:d3:18:c7:14:b7:9b:ae:8f:a5:ab:f5:92:ae:82:
         4d:62:0e:7d:7d:3f:c2:3b:e1:6f:c7:27:19:43:df:eb:f1:24:
         cc:db:fe:00:72:cd:81:0e:8c:6a:db:42:29:9c:8d:c9:95:39:
         5b:52:44:41:e6:19:78:f2:b6:9d:5b:0f:7c:50:23:f9:f7:be:
         77:93:30:91:7a:e2:3f:9d:71:a1:47:58:5d:49:21:9a:4f:5a:
         96:0b:c6:14:0f:52:fb:eb:ab:bc:74:a9:d0:be:c7:fc:7f:eb:
         39:83:2c:b8:b7:ec:77:52:de:18:64:39:75:7b:71:26:d6:ec:
         3e:08:7f:fb:3e:39:f0:7a:4c:cf:de:25:ad:19:0d:fe:bb:8d:
         a5:7e:6a:e0:65:ee:e1:f9:c2:90:b3:df:43:15:58:80:6c:61:
         20:3d:56:fd:7d:aa:b6:8c:e9:29:80:61:fe:61:ab:f4:8c:d5:
         8f:b6:1f:11:db:03:24:17:6c:31:19:21:31:60:ce:82:ca:44:
         c2:61:ce:11:0d:5d:8e:7c:2d:1f:a8:51:0e:39:19:1e:09:48:
         45:03:fe:f0:38:84:dd:d7:4a:c6:71:4f:c4:99:eb:29:bb:e9:
         e9:f2:4f:17:4c:ea:6f:e6:64:04:f9:e7:7c:24:ff:cc:2b:bb:
         81:18:10:4e:eb:46:e7:7d:52:0e:64:05:74:75:3a:1b:20:7e:
         92:11:71:d0:be:45:ac:0f:e3:2a:27:e1:48:42:10:41:16:db:
         b5:a9:34:c7:c4:44:bc:0f:66:9f:ae:d2:d6:2b:e8:d1:b0:78:
         39:e9:b2:e4:2f:91:0b:2e:e9:36:bb:9a:89:a2:5f:9a:9a:8d:
         54:1f:24:b9:e6:4b:2e:8e:13:cb:ac:d3:d1:26:df:3b:95:49:
         11:fe:25:4e:17:65:dc:ff:83:38:aa:60:0f:b2:b7:67:68:c9:
         e6:89:b1:62:17:09:2b:80:81:d6:da:18:d8:d6:e0:32:cc:ab:
         47:91:97:11:2b:e2:f8:45:e2:82:03:1d:26:29:74:e2:77:d5:
         a0:94:6a:10:35:70:79:cb:a0:6c:78:02:83:5c:8f:c4:bb:5f:
         60:b3:39:35:bf:fa:58:28:95:51:21:f4:a7:47:87:ea:20:57:
         94:8e:71:4b:76:96:84:99
  • Chrome uses the OS trusted root CA store but Firefox has its own trusted root CA store, so you need to add a corporate CA or self signed CA to the OS for Chrome but to Firefox directly for Firefox. If that is not the problem, can you post the cert without its key here? – Z.T. Feb 3 at 9:56
  • I have added that CA to firefox already. As I mention in my post, "server" name works correctly (it's not added as exception) so I don't think there's any problem with CA. I also updated my post just now to include my certificate – FilipK Feb 3 at 10:03
  • Sorry, don't know. I'm sure it's not a problem with amount of SubjAltNames in cert, because this should work fine: 1000-sans.badssl.com – Z.T. Feb 3 at 13:24
  • I have changed the order of altNames in openssl.cnf so that nrv01 is before server and nrv01 is now a valid domain but server is not – FilipK Feb 7 at 7:25
  • 1
    That is super cool and I suspect finding out what it does will require reading the code. – Z.T. Feb 7 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.