I have mutual TLS enabled on my nginx reverse proxy. I can view the site only when I have the client cert and custom CA installed in my keychain. This works in Safari and Chrome. However, in Chrome it always says "This cert cannot be trusted" despite having trusted always options selected on both the CA and the client cert. How can I get chrome to trust the cert?


1 Answer 1


The subject alt name wasn't defined. When generating the cert, I ran the following:

openssl x509 -req -days 365 -sha256 -in mydomain.com.csr -CA ca.crt -CAkey ca.key -set_serial 1 -out mydomain.com.crt -extfile mydomain.com.ext

where I had:


keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

DNS.1 = mydomain.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.