0

I created a certificate authority on my MacBook, and I'm using it to create a wildcard certificate. I have the root CA added as trusted into my system keychain. On Safari, it complains that the certificate is not standards compliance, and I'm not sure what piece I am missing. I'm not sure if I scrubbed all sensitive information from this or not, but it's my internal lab and not accessible from the internet.

I have my wildcard name in the Subject Alternative Name section. I used sha256 for the signature algorithm. The public key is 4096 bit. The duration of the certificate is 825 days.

Any idea what I am missing still?

   Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number:
                20:48:98:c3:05:9d:64:a1:ad:ad:db:0d:93:b9:8a:65:37:c7:d8:6f
        Signature Algorithm: sha256WithRSAEncryption
            Issuer: CN=Macbook Root Certificate Authority
            Validity
                Not Before: Jun 12 21:26:06 2022 GMT
                Not After : Sep 14 21:26:06 2024 GMT
            Subject:
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (4096 bit)
                    Modulus:
                    <snipped>
                    Exponent: 65537 (0x10001)
            X509v3 extensions:
                X509v3 Subject Alternative Name:
                    DNS:*.apps.ocp4.example.com
                X509v3 Key Usage:
                    Digital Signature, Key Agreement
                X509v3 Extended Key Usage:
                    TLS Web Server Authentication
                X509v3 Subject Key Identifier:
                    32:EC:2D:C5:2F:B1:BA:5A:53:A2:F5:E5:B1:A3:92:C8:B2:E1:D0:36
                X509v3 Authority Key Identifier:
                    keyid:FF:47:90:DB:B4:1A:BD:B5:55:BD:03:45:B0:DC:CA:20:1D:A2:A7:64
    
        Signature Algorithm: sha256WithRSAEncryption
        <snipped>

Edit: added CA certificate for reference

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:c2:88:e5:e2:2a:cb:5e:1b:4b:00:48:82:9e:8e:a2:99:c7:76:60
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Macbook Root Certificate Authority
        Validity
            Not Before: Jun 12 20:20:40 2022 GMT
            Not After : Jun  9 20:20:40 2032 GMT
        Subject: CN=Macbook Root Certificate Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    <snipped>
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                FF:47:90:DB:B4:1A:BD:B5:55:BD:03:45:B0:DC:CA:20:1D:A2:A7:64
    Signature Algorithm: sha256WithRSAEncryption
         <snipped>
Improve this question
4
  • 1
    I think you omitted too much information. Or does the certificate really has no subject, no basic constraints, no key usage ... " The duration of the certificate is 825 days." - server certificates are usually not issued for such a long time anymore. This seems to be on the very limit of support.apple.com/en-us/HT210176 - which got shortened to 398 days by support.apple.com/en-us/HT211025 - although this should not affect user added root CA.
    – Steffen Ullrich
    Jun 12, 2022 at 22:37
  • @SteffenUllrich: 5280 allows empty Subject in leaf if SAN is present, and CABforum both requires SAN and allows empty Subject for subscriber/leaf. KU is present; OP: RSA can never be used for keyAgreement so that is useless, but IDK any standard that prohibits it. (keyEncipherment can be used in TLS<=1.2 but is not recommended.) BC with CA:false is common on leaf but not required; BC with critical and CA:true is required on the CA, and so is KU with critical and keyCertSign -- do you have those?
    – dave_thompson_085
    Jun 13, 2022 at 1:24
  • @dave_thompson_085: I do believe I have those configured. Here is the relevant section of my CA certificate (added to original post) I used to sign the cert in the original question.
    – MikeA
    Jun 13, 2022 at 14:18
  • @SteffenUllrich I've tried various expirations including ones as low as 30 days, but that did not work either.
    – MikeA
    Jun 13, 2022 at 14:22

1 Answer 1

Reset to default
0

I created this .ext file

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = *.ocp4.example.com

Then I ran the following to generate my certificate:

openssl genrsa -out apps.ocp4.example.com.key 4096
openssl req -new -key apps.ocp4.example.com.key -out apps.ocp4.example.com.csr
openssl x509 -req -in apps.ocp4.example.com.csr -CA certs/rootCA.pem -CAkey private/rootCA.key -CAcreateserial -out apps.ocp4.example.com.pem -days 825 -sha256 -extfile apps.ocp4.example.com.ext

This allowed Safari to securely access the web pages using the CA in my system trust store.

Improve this answer
1
  • I think it was the fact that my original method for creating the certificate (using Ansible modules) was not setting the Subject in my certificate. The manual method listed did. I was able to modify my Ansible tasks to include the Subject, and then it worked as expected.
    – MikeA
    Jun 13, 2022 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.