I'm in charge of my organization's certificate scheme, I am trying to conform to the new requirements enforced by Google Chrome regarding RFC2818 (the requirement for "Subject Alternate Name" in a server certificate).
In my attempts, I am using EasyRSA (which uses OpenSSL) to generate my root CA and my server and user certificates. I am successfully generating client certificates which look completely valid in Windows MMC, however Chrome doesn't list them when it prompts for a client certificate when accessing our website (which is configured to require a certificate)
These are the properties of the old certificate which works (is shown on the Chrome prompt window), its intended purposes as shown on the MMC list view is <All>:
This certificate is intended for the following purpose(s): * All application policies Version: V3 Serial number: a1 ed ... Signature algorithm: sha1RSA Signature hash algorithm: sha1 Issuer: MyOrganization Valid from: Sunday, June 23, 2013 3:35:55 PM Valid to: Sunday, January 01, 2040 2:59:59 AM Subject: My Name, email@example.com Public key: RSA (1024 Bits) Authority Key Identifier: KeyId=0f d9 ... Thumbprint algorithm: sha1 Thumbprint: 40 11 ...
And these are the properties of the certificate which is NOT shown, which on the MMC list view is show as "Client Authentication" in the intended purposes:
This certificate is intended for the following purpose(s): * Proves your identity to a remote computer Version: V3 Serial number: 07 Signature algorithm: sha256RSA Signature hash algorithm: sha256 Issuer: MyOrganization2 Valid from: Thursday, April 27, 2017 7:29:09 PM Valid to: Sunday, April 25, 2027 7:29:09 PM Subject: My Name Public key: RSA (2048 Bits) Basic Constraints: Subject Type=End Entity Path Length Constraint=None Subject Key Identifier: c6 cf ... Authority Key Identifier: KeyId=0a 21 ... Enhanced Key Usage: Client Authentication (220.127.116.11.18.104.22.168.2) Key Usage: Digital Signature (80) Thumbprint algorithm: sha1 Thumbprint: 0a 12 ...
I have exhausted my internet search abilities on this matter, please help if you can. Alternatively, please help on how to create valid certificate chain (CA, server, client) using OpenSSL (or EasyRSA) which conforms to RFC2818 and is recognized by Google Chrome (v.58). Thanks!
This is the output from running
openssl s_client to my server:
CONNECTED(0000011C) --- Certificate chain 0 s:/C=IL/L=*****/O=*****/CN=www.*****.com i:/C=IL/O=*****/CN=***** Intermediate CA 1 s:/C=IL/O=*****/CN=***** Intermediate CA i:/C=IL/L=*****/O=*****/CN=***** Root CA --- Server certificate -----BEGIN CERTIFICATE----- MIIFhz... -----END CERTIFICATE----- subject=/C=IL/L=*****/O=*****/CN=www.*****.com issuer=/C=IL/O=*****/CN=***** Intermediate CA --- No client certificate CA names sent --- SSL handshake has read 3006 bytes and written 401 bytes --- New, TLSv1/SSLv3, Cipher is RC4-MD5 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : RC4-MD5 Session-ID: B30B0... Session-ID-ctx: Master-Key: 3C40F... Key-Arg : None Start Time: 1493541902 Timeout : 300 (sec) Verify return code: 20 (unable to get local issuer certificate) ---