Google chromes update to version 58 started invalidating my self signed certificates a few days ago. It was complaining about missing
I did some research and tried a couple of suggestions (which wouldn't work) but then found this post, the only one that I could get working.
Or did I?
Yay chrome is now accepting my newly generated and imported certificates and I was on my way,
until, I hit a page in my
PHP web app that requires loading data from another micro web-service on the same dev machine.
stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages: error:14090086:SSL routines:ssl3_get_server_certificate:
I have been googling and tinkering with this for about 4 hours now and just cannot get my head around it.
Why is chrome accepting my certificate. HOWEVER tools like
openssl s_client all giving me
unable to verify the first certificate or
invalid certificate? I have tried passing the certificate as a parameter and still apparently invalid.
Debugging with curl and openssl passing the certificate file as a parameter continues to give me this error
SSL certificate verify result: unable to get local issuer certificate (20),
I think Im gonna be completely bald by the end of the day.
The virtual machine is my local development environment so I do have multiple domains with their own cert and keys
VM sits on IP 192.168.33.10. meaning chrome is not accessing localhost. However curl and openssl s_clinet are trying to access locahost
Server is a VM running ubuntu 14.04
Installed self signed certificate on host machine with MMC (Microsofts management console)
Error is definitely coming from the client class trying to access a web-service.
I have tried passing the certificate as a parameter and still apparently invalid.
I am fully aware I can set verify peer to false or pass --insecure to the request but I don't learn anything from that.
SSL-Session: Protocol : TLSv1.2
sudo dpkg-reconfigure ca-certificatesto update certs
I have reached frustration level 9000
I regenerated a new certificate with v3 extension turned off and Back to chrome telling me
subjectAltName is missing but curl is working. I need to work out how to genrate certs that both curl and chrome will accept.
localhostis not under the alt names. Let me try that and ill let you know how I get on.
curl: (60) SSL certificate problem: unable to get local issuer certificateSo I dont believe its a cacert location issue
127.0.0.1 my.domain.devis indeed present in the hosts file. anything else in that file required? when i add -showcerts param to my openssl request i get the expected certificate back. but for whatever reason it cant get issuer.. when its clearly there when you do an
openssl x5... --text
--cacertargument and its still saying it cannot get the issuer. I cant see how it could be an installation(adding to trust store) issue if im passing the crt directly? And if its a certificate issue howcome chrome can handle it fine and I can output the content correctly into text. so strange. I might have to set up another VM with same SSL signing method and see if it is replicate-able