I'm learning how to test HTTPS locally and found that articles written before ca. 2019 (e.g., 1, 2, 3) contain only a few steps, whereas later posts (e.g., 4, 5, 6, 7, 8, 9) always make sure that v3 extensions are also configured.

Why is this?


1 Answer 1


As of 8/15/2023, the reasons seem to be specific to Chrome / Chromium as it won't process self-signed certificates without the following X.509 v3 extensions set:

I've been using the following one-liner lately to produce a private key and a self-signed certificate for testing HTTPS in Chrome and Safari:

openssl req -x509 -new -nodes                                      \
  -newkey RSA:2048                                                 \
  -days 365                                                        \
  -subj '/C=US/ST=Denial/L=Earth/O=Dis/CN=anything_but_whitespace' \
  -addext 'subjectAltName = DNS:localhost'                         \
  -addext 'authorityKeyIdentifier = keyid,issuer'                  \
  -addext 'basicConstraints = CA:FALSE'                            \
  -addext 'keyUsage = digitalSignature, keyEncipherment'           \
  -addext 'extendedKeyUsage=serverAuth'                            \
  -out self-signed-server-and-root-ca.crt                          \
  -keyout server-and-root-ca-private.key

Firefox is a whole another story though as it has different rules and also uses its own trust store, effectively requiring one to use 2 key-pairs.

Notes on subjectAltName

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .