Where SAN means: Subject Alternative Name.
I feel I have a basic misunderstanding in which certificate the SAN stuff shall go: ca or server or both or what?
It might be 3 Years or more in the past, where chrome / chromium browsers required the occurrence of the SAN extension in certificates.
While fierfox still accepts
hostname / domain name as a usual common name (CN), chromium doesn't.
Recent chromium versions are verifying the CN by the SAN extension and moreover don't take care of the CN.
So far so good. I'd like to refer to a google's statement: scroll to
Error: "Subject Alternative Name Missing" or NET::ERR_CERT_COMMON_NAME_INVALID or "Your connection is not private"
In here they state
... using a valid, trusted server certificate
Am I right to assume that it's not the Root CA certificate which I can import to chromium via the
Settings > Manage certificates > Authorities Tab?
Such Root CA certificate which I am importing to firefox (where it is recognized correctly) is generated like this:
openssl req -new -x509 -days 365 -extensions v3_ca -keyout mosq_ca.key -out mosq_ca.crt -subj "/C=CA/ST=BC/L=your-city/O=ca.your-domain.com/OU=ca/CN=your-hostname/[email protected]"
Within the Root CA certificate I generate a server certificate (used on mosquitto) like this:
openssl genrsa -out mosq_serv.key 2048
Server certificate signing request
openssl req -new -key mosq_serv.key -out mosq_serv.csr -subj "/C=your-country/ST=your-state/L=your-city/O=server.your-domain.com/OU=server/CN=your-hostname/[email protected]"
Self CA signed server certificate
openssl x509 -req -in mosq_serv.csr -CA mosq_ca.crt -CAkey mosq_ca.key -CAcreateserial -out mosq_serv.crt -days 365
- private key
- Root CA certificate
- Self CA signed server certificate
Those three are provided to mosquitto config and it works for most browsers, when importing the Root CA certificate as an Authority, except for chrome / chromium. And I guess it is due to the statement mentioned above.
I was able to put the SAN into the Root CA certificate via openssl's
-config option. That didn't help against the
san.cfg is this:
[req] distinguished_name = req_distinguished_name x509_extensions = v3_req prompt = no [req_distinguished_name] C = <myC> ST = <myST> L = <myL> O = <myO> OU = <myOU> CN = <myCN> emailAddress = <myemailAddress> [v3_req] basicConstraints = CA:true subjectKeyIdentifier = hash authorityKeyIdentifier = keyid,issuer #basicConstraints = critical,CA:TRUE #subjectKeyIdentifier = hash #authorityKeyIdentifier = keyid:always,issuer:always #keyUsage = keyEncipherment, dataEncipherment #extendedKeyUsage = serverAuth subjectAltName = @alt_names [alt_names] DNS.0 = <myCN>
Then issue Root CA certificate
openssl req -new -x509 -days 365 -extensions 'v3_req' -keyout mq_srv_ca.key -out mq_srv_ca.crt -config san.cfg
I was not able to gain a SAN for the Self CA signed server certificate since I don't know how to apply with
-config. And I am not sure whether it needs to be done. When reading the statement from google exactly, one might think it should be done.
If so, how to do this? And how to provide the result to chrome / chromium?
Btw. I am using Paho's js utility for browser testing