I've been using the same wildcard certificate for some time now with my internal systems. I've added (and trusted) the certificate to my OSX Keychain. However, I'm still getting an error when attempting to access my sites with Chrome:

Attackers might be trying to steal your information from jenkins.kensnet.priv (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID
Subject: *.kensnet.priv
Issuer: *.kensnet.priv
Expires on: Oct 18, 2023
Current date: May 16, 2017

This server could not prove that it is jenkins.kensnet.priv; its security certificate is from [missing_subjectAltName]. This may be caused by a misconfiguration or an attacker intercepting your connection.

How can I get Chrome to allow this wildcard certificate?


You need to recreate the certificate and assign a SubjectAltName. This works for me on OSX 10.11.6 with Brew:

openssl req -x509 -sha256 -nodes -days 3650 \
-newkey rsa:2048 -keyout visible.priv.key \ 
-out kensnet.priv.crt -subj "/CN=*.kensnet.priv" \
-reqexts SAN -extensions SAN -config <(cat /usr/local/etc/openssl/openssl.cnf \
<(printf '[SAN]\nsubjectAltName=DNS:*.kensnet.priv'))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.