I've got a Mayan EDMS running on a computer on the local network. The Web App is exposed via HTTPS on the non-standard port 8001 and it uses an SSL certificate that is signed by our own CA.
The CA is installed in my browser, but my browsers won't accept the certificate, saying:
Firefox does not trust this site because it uses a certificate that is not valid for <locally resolved hostname>:8001. Error code: SSL_ERROR_BAD_CERT_DOMAIN"
Your connection is not private
This server could not prove that it is <locally resolved hostname>; its security certificate does not specify Subject Alternative Names. This may be caused by a misconfiguration or an attacker intercepting your connection.
Proceed to (unsafe)
The CN used to be <locally resolved hostname>, but when that suddenly stopped working, I changed it to <locally resolved hostname>:8001.
Chromium will let me proceed, but FF won't, saying the server uses HSTS.
What are the reasons a browser would reject a certificate with the error codes given?
- Can these error codes occur if there is something wrong with the certificate other than the CN or hostname, like something with the CN, algorithms, protocol negotiation...
- Can/should the CN contain the port? FF's message seems to imply this and it seems reasonable, but Chromium says the CN with the port is invalid, including the port didn't fix the problem, and I'm finding conflicting information on this.
- Is there anything in the TLS/SSL/HSTS standards that does not allow local domain names or domains with local IPs as CNs/hostnames in certificates?