I have the following "chain" of certificates on a test machine right now:
- A self-signed CA cert, in my Keychain and trusted & trusted by Firefox.
A CA cert with with the following,
X509v3 Name Constraints: critical Permitted: DNS:mydomain.net DNS:.mydomain.net
A non-CA cert with signed by the above.
The test webserver serves the latter two certs; the first is marked as "trusted" in Keychain in OS X, in Firefox itself, and on my Linux side, also in FF and by
On OS X, Firefox accepts the connection as secure; Chrome and Safari do not. It looks like Chrome & Safari just uses whatever the OS uses for crypto purposes, so here, OS X is the issue. Viewing the cert shows:
"This certificate cannot be used (unrecognized critical extension)" Extension: Name Constraints (22.214.171.124) Critical: YES Data: <a sequence of octets>
I'm guessing because I'm seeing a sequence of octets, and not a nice decoded view (like I do with other extensions), that this is the extension causing the error.
I can't get it to work on Linux either under Chrome (works fine in FF, again); there, however, it doesn't seem to be able to find the root cert (whereas on OS X it can); I think this is because I don't understand how to accept my self-signed cert. (The Internet says
certutil, and I've tried just about every combination of that to no avail.)