We run an internal Certificate Authority powered by an Ubuntu 16.04 server and an OpenSSL backend for internal resources, on a mixed Windows / Linux environment.
This CA is used with some internal websites in an attempt to provide valid, trusted site certificates for internal websites, software deployments, etc. We have one problem.
The CA Root certificate is pushed to all our Windows systems by GPO, or were manually installed. However, every certificate signed by that CA ends up giving some problems - Chrome and Firefox both indicate that the certificate has an invalid common name, while other utilities such as an XMPP server here can't validate the certificate even if the CA cert is in the trust stores.
Only Internet Explorer respects the certificate. Unfortunately, we are a Chrome and Firefox house, so using IE for everything is going to be a problem.
Has anyone figured out a solution to make an OpenSSL CA cert and its signed certificates for issued certs not have an "Invalid Common Name" error on Chrome and Firefox, and thus permit internal certificates to be seen as 'valid'?