3

I don't know if what I'm asking is even possible, but I'll ask anyway.

I'm trying to get FireFox or Chrome to trust a self-signed certificate used on a website I'm running locally. I started up an ubuntu server and ran these commands:

# go to /etc/certs directory
mkdir /etc/certs

# make certificate for root CA
openssl genrsa -out root.key 2048
openssl req -x509 -sha256 -nodes -key root.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=root.example.com" -days 3650 -out root.crt

# make certificate for enduser
openssl genrsa -out enduser.key 2048
openssl req -new -sha256 -nodes -key enduser.key -subj "/C=CA/ST=ON/O=HelloWorld/CN=enduser.example.com" -out enduser.csr
openssl x509 -req -in enduser.csr -CA root.crt -CAkey root.key -CAcreateserial -out enduser.crt -days 500 -sha256

# change perm
chmod 755 /etc/certs/*

# install apache2 webserver and setup a web page
apt-get install -y apache2;
a2enmod ssl;

Then I made the file /etc/apache2/sites-available/enduser.example.com.conf

<VirtualHost 192.168.0.43:443>
  ServerName enduser.example.com
  DocumentRoot /var/www/html/
  SSLEngine on
  SSLCertificateFile /etc/certs/enduser.crt
  SSLCertificateChainFile /etc/certs/root.crt
  SSLCertificateKeyFile /etc/certs/enduser.key
</VirtualHost>

Then I ran these commands:

a2ensite enduser.example.conf
systemctl restart apache2

Then in FireFox, I added the root.crt to my certificate manager like this:

enter image description here

I also clicked on Edit Trust... and check marked both Let this certificate identify websites. and Let this certificate identify mail users..

I updated my windows hosts file to have the entry 192.168.0.43 enduser.example.com.

When I visit https://enduser.example.com, I still get the Warning: Potential Security Risk Ahead. When I click Advanced... on the page and click View Certificate, I see two certificates: one for enduser.example.com and one for root.example.com. The details for root.example.com is 100% identical to the image above.

Is it even possible for my Firefox to trust this self signed certificate? If so, what did I do wrong?


This is what I see after clicking Advanced Tab enter image description here

And clicking on the SSL_ERR_BAD_CERT_DOMAIN shows this:

https://enduser.example.com/



Unable to communicate securely with peer: requested domain name does not match the server’s certificate.



HTTP Strict Transport Security: false

HTTP Public Key Pinning: false



Certificate chain:



-----BEGIN CERTIFICATE-----

MIIDHjCCAgYCFFzNBIu5qZcCIsrmOmizCFT98WHcMA0GCSqGSIb3DQEBCwUAMEox

CzAJBgNVBAYTAkNBMQswCQYDVQQIDAJPTjETMBEGA1UECgwKSGVsbG9Xb3JsZDEZ

MBcGA1UEAwwQcm9vdC5leGFtcGxlLmNvbTAeFw0yMzAyMjIyMjEwMTJaFw0yNDA3

MDYyMjEwMTJaME0xCzAJBgNVBAYTAkNBMQswCQYDVQQIDAJPTjETMBEGA1UECgwK

SGVsbG9Xb3JsZDEcMBoGA1UEAwwTZW5kdXNlci5leGFtcGxlLmNvbTCCASIwDQYJ

KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJvaQkwLge2jd4YL6j4slthkJH2o5rTB

nchT14HfFZYMnaW5c7/ZJsG+yHyRDf7L57hmpc5UaMlZRoZI/2QJy8uGB6MiCRLh

QOPkzvpEQQSnx/6u9CiQpXz2dM6nLKe706wqrq5DU/YT1Fj+Inr5jJ/PcDWf0HNs

i6jZHJzZmkh19aIZXz6q5SAWjGSPyG02IqF268kiuzGBvNqsKBPijswBMSLLH4Td

5qyIWr2JU+QjaAfpmtOz8gFSPfFpkppCjs5IhNiDUAbOQeIsjzoMFGaFk6VuHVyc

yABKqwekTdzQBBLMb0VR2gt9o4d9qRSyuh+zzB6g62Sec7Wr+NG4umMCAwEAATAN

BgkqhkiG9w0BAQsFAAOCAQEANXughhlDE1aXokSozjRr2MbZ2WFDS11nj6vTzMC3

HfUDFp8hTXGxSR378EppkkwVhUp+YIBJjjlqUoSsWxsXTLs1SORfwKPOBZkcUrgo

SFjnjQSc/1jdh2fBuHkDRSmFceYzD0uWu6nXb38bD2mxB4nkmaVuBVW/w6IQ6Bz1

0lWivyb2VtX9ggL/7PWNimvGVu2gq27hrp+B9OZIfhjhAr5JP6rwUTbN4gS0TIoJ

Pb8Xpu5+fvBZkokt4bs4xJSc2llnyM5alDtVCgkSsY/cft50wME8VVd5PMOHHk0c

OHwGmklGXznF+nCo1wQpndEWvmqsYRYHK9HWewe7lo8QMQ==

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

MIIDdTCCAl2gAwIBAgIUJzjku/HCYV6WBEpGb0ZJVJ9o9wIwDQYJKoZIhvcNAQEL

BQAwSjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgMAk9OMRMwEQYDVQQKDApIZWxsb1dv

cmxkMRkwFwYDVQQDDBByb290LmV4YW1wbGUuY29tMB4XDTIzMDIyMjIyMTAwOVoX

DTMzMDIxOTIyMTAwOVowSjELMAkGA1UEBhMCQ0ExCzAJBgNVBAgMAk9OMRMwEQYD

VQQKDApIZWxsb1dvcmxkMRkwFwYDVQQDDBByb290LmV4YW1wbGUuY29tMIIBIjAN

BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw/G/F1cd1KQLGaMToh9DdVDdIB/+

bV40QkOr1xXV0nfxwCgtjaEry+4jOs1lVFf5k4fKCQBMFgmVVKnZIcYFgPYEEbSM

bSZJxchsLgf8Z2kE/RjD1qwZzUUIygJEFk3Ipik9RSHJ9CDIpgj0RDkXZ9g2ecw2

m6P0cYW8PDucrydMdsaZXflvHo3kZEQDuOffvaxQaxMPvTvTnapuPPkmW8ejv1Qb

rYHHUJvesSiGoevKOZjB9kqxa2nGem3lTb2/iHveu4q1lcOkfEg76uLWppiu7web

GmW7UNpz1zZaXiDHRjNWkmQMbY/rPyHZeg6n/csHG2WDnQ060XVlMexMFwIDAQAB

o1MwUTAdBgNVHQ4EFgQU9UUeSV4VP8RKipOidcY6uEOEWVMwHwYDVR0jBBgwFoAU

9UUeSV4VP8RKipOidcY6uEOEWVMwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B

AQsFAAOCAQEAEyboEp5kyAsfMKy9wgkwXzfRGkOMTq63D68jBmszcUwaGEI1Fq7o

GfmIciACFMUS12F5ZfgIYdVudzgwk9cWybXVDHU6UquzEk4WtoAhL9Fsecfe4oU8

BAVTUN9A8HP7IoIkA3ueIuEAzOpBm/eY/HuT4ifgJEkiF2RnNG+wcaoX8ySVrOPP

PEHqVaxvIfDKj2RxxsxQpR7VPeDyaSiex3Hb+6cGCV9grCdeQkzV/3NQk305jOBS

usSo/d6DBngB7nk0ySaUt5CPdKaJKove1yhdBopbzYzUfNZ96AvZUADuoJ0z/HNa

aHxvM9FbyU3RtYvXEbVqT5tKnytU3t1ahg==

-----END CERTIFICATE-----

4
  • 1
    "When I click Advanced... on the page " - it should show you a more detailed error there, i.e. more than just potential security risk. What exactly is shown on this page? Also note that your certificate has no subject alternative names, which is expected for many years for certificates (at least in Chrome). Feb 22, 2023 at 22:53
  • @SteffenUllrich I just added a screenshot of the Advanced tab. Ok, let me take a moment to research and understand implications of the subject alternative names.
    – John
    Feb 22, 2023 at 22:57
  • Did you edit the trust for this root certificate to allow it to identifty websites? Firefox can for sure use custom CA's.
    – Teun Vink
    Feb 22, 2023 at 22:58
  • @teunVink - Yup, i'll update question to say that I "Edit Trust..." By selecting "This certificate can identify websites"
    – John
    Feb 22, 2023 at 23:01

1 Answer 1

4

... requested domain name does not match the server’s certificate.

The server certificate MUST have the domain name in the subject alternative names (SAN) section - yours don't. This is a long standing requirement and is enforced in Chrome and for many years. Firefox had supported using the CN instead of SAN for a long time for backward compatibility, but seem to have this disabled recently and now always requires SAN like Chrome.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .