0

I created a certificate authority on my MacBook, and I'm using it to create a wildcard certificate. I have the root CA added as trusted into my system keychain. On Safari, it complains that the certificate is not standards compliance, and I'm not sure what piece I am missing. I'm not sure if I scrubbed all sensitive information from this or not, but it's my internal lab and not accessible from the internet.

I have my wildcard name in the Subject Alternative Name section. I used sha256 for the signature algorithm. The public key is 4096 bit. The duration of the certificate is 825 days.

Any idea what I am missing still?

   Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number:
                20:48:98:c3:05:9d:64:a1:ad:ad:db:0d:93:b9:8a:65:37:c7:d8:6f
        Signature Algorithm: sha256WithRSAEncryption
            Issuer: CN=Macbook Root Certificate Authority
            Validity
                Not Before: Jun 12 21:26:06 2022 GMT
                Not After : Sep 14 21:26:06 2024 GMT
            Subject:
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (4096 bit)
                    Modulus:
                    <snipped>
                    Exponent: 65537 (0x10001)
            X509v3 extensions:
                X509v3 Subject Alternative Name:
                    DNS:*.apps.ocp4.example.com
                X509v3 Key Usage:
                    Digital Signature, Key Agreement
                X509v3 Extended Key Usage:
                    TLS Web Server Authentication
                X509v3 Subject Key Identifier:
                    32:EC:2D:C5:2F:B1:BA:5A:53:A2:F5:E5:B1:A3:92:C8:B2:E1:D0:36
                X509v3 Authority Key Identifier:
                    keyid:FF:47:90:DB:B4:1A:BD:B5:55:BD:03:45:B0:DC:CA:20:1D:A2:A7:64
    
        Signature Algorithm: sha256WithRSAEncryption
        <snipped>

Edit: added CA certificate for reference

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            56:c2:88:e5:e2:2a:cb:5e:1b:4b:00:48:82:9e:8e:a2:99:c7:76:60
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Macbook Root Certificate Authority
        Validity
            Not Before: Jun 12 20:20:40 2022 GMT
            Not After : Jun  9 20:20:40 2032 GMT
        Subject: CN=Macbook Root Certificate Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                Modulus:
                    <snipped>
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                FF:47:90:DB:B4:1A:BD:B5:55:BD:03:45:B0:DC:CA:20:1D:A2:A7:64
    Signature Algorithm: sha256WithRSAEncryption
         <snipped>
Improve this question
4
  • 1
    I think you omitted too much information. Or does the certificate really has no subject, no basic constraints, no key usage ... " The duration of the certificate is 825 days." - server certificates are usually not issued for such a long time anymore. This seems to be on the very limit of support.apple.com/en-us/HT210176 - which got shortened to 398 days by support.apple.com/en-us/HT211025 - although this should not affect user added root CA.
    – Steffen Ullrich
    Jun 12, 2022 at 22:37
  • @SteffenUllrich: 5280 allows empty Subject in leaf if SAN is present, and CABforum both requires SAN and allows empty Subject for subscriber/leaf. KU is present; OP: RSA can never be used for keyAgreement so that is useless, but IDK any standard that prohibits it. (keyEncipherment can be used in TLS<=1.2 but is not recommended.) BC with CA:false is common on leaf but not required; BC with critical and CA:true is required on the CA, and so is KU with critical and keyCertSign -- do you have those?
    – dave_thompson_085
    Jun 13, 2022 at 1:24
  • @dave_thompson_085: I do believe I have those configured. Here is the relevant section of my CA certificate (added to original post) I used to sign the cert in the original question.
    – MikeA
    Jun 13, 2022 at 14:18
  • @SteffenUllrich I've tried various expirations including ones as low as 30 days, but that did not work either.
    – MikeA
    Jun 13, 2022 at 14:22

1 Answer 1

Reset to default
0

I created this .ext file

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = *.ocp4.example.com

Then I ran the following to generate my certificate:

openssl genrsa -out apps.ocp4.example.com.key 4096
openssl req -new -key apps.ocp4.example.com.key -out apps.ocp4.example.com.csr
openssl x509 -req -in apps.ocp4.example.com.csr -CA certs/rootCA.pem -CAkey private/rootCA.key -CAcreateserial -out apps.ocp4.example.com.pem -days 825 -sha256 -extfile apps.ocp4.example.com.ext

This allowed Safari to securely access the web pages using the CA in my system trust store.

Improve this answer
1
  • I think it was the fact that my original method for creating the certificate (using Ansible modules) was not setting the Subject in my certificate. The manual method listed did. I was able to modify my Ansible tasks to include the Subject, and then it worked as expected.
    – MikeA
    Jun 13, 2022 at 23:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .