I just added a NAS (network attached storage) to my LAN and I'd like to access it via
HTTPS. Everything works, except that when I browse to it, chrome responds with "Not Secure" in the address bar, and there's a strikethrough line in the "https" protocol part of the URL. I'm having a similar problem with Mozilla Firefox.
- On my PC, which is running Linux Mint 17.3, I created a root certificate authority by executing
sudo /usr/lib/ssl/misc/CA.sh -newca.
- I logged into the NAS using http and created a CSR (certificate signing request), which I then downloaded to my PC. The file has a .csr extension.
- I then signed the .csr file using the command
sudo openssl ca -out myCert.pem -infiles myCert.csr.
- I imported the certificate myCert.pem into the NAS using it's web interface.
- I added the CA certificate myCaCert.pem on my PC to its certificate store by moving it to
/usr/share/ca-certificates/extra/myCaCert.crtand then running
sudo dpkg-reconfigure ca-certificates.
- I then checked that the end certificate myCert.pem file worked okay by running
openssl verify myCert.pem. The output was "myCert.pem: OK".
- I then imported the root certificate myCaCert.pem file into Mozilla Firefox and chrome.
After completing these steps, Firefox and chrome both show that the url for the NAS via https is insecure. Is it necessary to set up a service on my PC that has the myCaCert.pem file in order to serve the file? Not sure what to do at this point...
As suggested by dave_thompson_085, I checked the security errors in Chrome in the developer tools. The following two errors are being displayed:
(1) Subject alternative name missing: The certificate for this site does not contain a Subject Alternative Name extension containing a domain name or IP address.
(2) Certificate error: There are issues with the site's certificate chain (net::ERR_CERT_COMMON_NAME_INVALID).
I thought subject alternative names were optional.... I'll try generating another CSR with a SAN....