I've created a developer cert with my companies CA for my development box. The CN is the FQDN of my development box mybox.example.com, but I've also added subjectAlternative names that include localhost so even when I'm using localhost the cert is trusted.
The relevant details are:
Subject: CN=mybox.example.com; O=cool org; OU=Acme Issued by: CN=Acme CA 1; O=IT; OU=Acme Subject Alternative Names: DNS Name: localhost DNS Name: mybox.example.com . . . others . . .
NOTE: The companies CA certs are loaded in my browser so all certs signed by this Certificate Authority are trusted in the browser.
When I'm on my development box (i.e,
mybox.example.com) and open my local browser to
https://localhost:8443/myapp, the browser shows the certificate as trusted (as I expected it would). I can also use my FQDN name of
https://mybox.example.com:8443/myapp and the browser also shows the certificate as trusted.
In the above case, I'm actually running on an EC2 instance.
I'm first logged into an AWS Linux Desktop, and then I ssh to my EC2 instance and have X forwarding enabled (which allows me to open chrome on my EC2 instance and have it displayed on my AWS Desktop). The diagram looks like this:
AWS Desktop => ssh (with X Forwarding) ==> EC2 Instance (mybox.example.com) XWindows Server <-----------------------------> chromium-browser MyApp:8443
This all works perfectly as expected. The chromium-browser running on my EC2 instance uses URL
https://localhost:8443/myapp to connect to
MyApp:8443 via localhost and it all works and the browser says the certificate is trusted.
Next, however, the browser says the certificate is not trusted, and I don't know why. The diagram looks like this:
AWS Desktop ==> ssh tunnel (on port 8443) ==> EC2 Instance (mybox.example.com) chromium-browser https://localhost:8443/myapp <----> myapp:8443
I have configured ssh tunnels and X Forwarding in my
$HOME/.ssh/config file as follows:
Host mybox.example.com dev HostName mybox.example.com ForwardX11 yes ForwardX11Trusted yes LocalForward 8080 localhost:8080 LocalForward 8443 localhost:8443
The above configuration allows me to open X windows apps on my EC2 instance and have them displayed on my AWS Linux Desktop. And also sets up ssh tunnels for ports 8080 and 8443.
So when I open my browser on my AWS Desktop host, I can hit the apps that are running on my EC2 instance. When I do this, the chromium browser running on my AWS Desktop complains that the certificate is not trusted (even though it is the same certificate as served in the 1st example which is trusted).
My question is why is the certificate not trusted when going through the ssh tunnel?
Searching for this answer is difficult because of the complexity of the setup.
Answers to comments
What exactly does the browser say?
@Steffen Ullrich commented:
"the browser says the certificate is not trusted" - what exactly does the browser say. Please provide the exact error message you get, including the advanced details offered.
It says Not Secure next to the URL, and the string https of the URL is in red and has a red strikethrough on it.
If I click to view the certificate, there is nothing highlighted in the certificate to indicate what the browser doesn't like (but I'm not sure what if anything I would see). I can't share the exact cert with you for company privacy reasons.
Here is a screenshot
The page shows this warning page (I clicked on Show advanced, as requested in the comment).
Check both browsers CA store
Note that the browser uses its own root CA store, so you need to check what root CA are installed in the specific browser instance you are using.
This comment resulted in me finding the answer. When I checked the browser's on my AWS Desktop, I found that the CA store did have the internal CA certs needed, but the Anchor (top level) Root CA was not trusted. I didn't track down why but instead copied the CA cert from the working browser (EC2) to the AWS Desktop browser and the problem went away.
The trust change was:
CN=mybox.example.com; O=cool org; OU=Acme CN=Acme CA 1; O=IT; OU=Acme <<< Trusted on EC2 not trusted on AWS Desktop
Please feel free to write this up as an answer and I'll select it.