0

I've added SSL to a website (Apache 2.2 w/ Centos 6) using a self signed key. Chrome, FF, and IE displays the following:

Chrome

Your connection is not private Attackers might be trying to steal your information from test.example.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID

FF

Your connection is not secure The owner of test.example.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.

IE

There’s a problem with this website’s security certificate This might mean that someone’s trying to fool you or steal any info you send to the server. You should close this site immediately.

Is this expected? If not, how should the site be configured. Below is what I have done.

Apache is configured as:

<VirtualHost *:443>
    ServerName test.example.com
    DocumentRoot /var/www/test/html
    ErrorDocument 404 /error-404.html
    SSLEngine on
    SSLCertificateKeyFile /etc/pki/tls/private/test_key.pem
    SSLCertificateFile /etc/pki/tls/certs/test_crt.pem
    <Directory "/var/www/test/html">
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
        RewriteEngine On
        #Include /var/www/httpd/private.conf
    </Directory>
</VirtualHost>

My keys were generated as:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -aes-128-cbc -out test_key.pem
# For the following command, left all as default values
openssl req -new -key test_key.pem -sha256 -days 365 -out test_csr.pem
cp test_key.pem test_key.pem.tmp
openssl rsa -in test_key.pem.tmp -out test_key.pem
rm -f test_key.pem.tmp
openssl x509 -req -in test_csr.pem -signkey test_key.pem -sha256 -days 365 -out test_crt.pem
sudo cp test_key.pem /etc/pki/tls/private/test_key.pem
sudo cp test_csr.pem /etc/pki/tls/private/test_csr.pem
sudo cp test_crt.pem /etc/pki/tls/certs/test_crt.pem
rm -f test_key.pem
rm -f test_csr.pem
rm -f test_crt.pem
Improve this question
1
  • Out of curiosity, any reason not to use a free CA-signed cert from letsencrypt ?
    – ivanivan
    May 15, 2017 at 12:30

2 Answers 2

Reset to default
2

This is the expected behavior of browsers. These warnings are there to discourage users from visiting this site because the browser can not determine if this is actually the expected certificate for this site or someone impersonating the site, like in a man in the middle attack. Essentially a self-signed certificate is saying "trust me, I'm the correct certificate" and there is no way to verify this claim.

Improve this answer
2
  • Thanks Steffen, Maybe I am mistaken, but I thought in the past most if not all browsers would still give a warning, but state that the certificates were self signed. Does it look like my setup is correct?
    – user1032531
    May 14, 2017 at 16:44
  • 1
    @user1032531: warnings have been changed over time to better discourage users from visiting such site. At the end there is no difference in non-existing trust between a self-signed certificate and a certificate signed by an unknown CA - an attacker could create both.
    – Steffen Ullrich
    May 14, 2017 at 16:48
0

Since this is your self signed certificate and doesn't belong to any certificate authority, browsers will certainly throw error.

In case of https, first step is handshake. In handshake process, browser checks if the authority of the certificate installed on server is in the list of browsers certificate list. Since this certificate is signed by you, by no means, it will be in the list of browser.

Still if you're working locally, then you may import the certificate in your browser and if any domain name is also given in the certificate then you need to modify host file while is in Linux kept under /etc which in windows kept under c:\Windows\System32\Drivers\etc\

good luck.... :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .