0

Im trying to create a self-signed certificate to use a HTTPS connection to access my internal site (jira.intranet.com). I have successfully followed this article https://security.stackexchange.com/questions/74345/provide-subjectaltname-to-openssl-directly-on-command-line (3rd answer), to address Google Chrome complaining about no subjectAltName.

Here's the commands I have used.

openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 3650 -key ca.key -subj "/C=UK/ST=State/L=Locality/O=Home/CN=Home Root CA" -out ca.crt
openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/C=UK/ST=State/L=Locality/O=Home/CN=*.intranet.com" -out server.csr
openssl x509 -req -extfile <(printf "subjectAltName=DNS:jira.intranet.com,DNS:www.jira.intranet.com") -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

openssl x509 -in server.crt -text -noout

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            c6:0f:5d:0d:40:83:18:fb
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=UK, ST=State, L=Locality, O=Home, CN=Home Root CA
        Validity
            Not Before: Jul 27 22:14:13 2018 GMT
            Not After : Jul 24 22:14:13 2028 GMT
        Subject: C=UK, ST=State, L=Locality, O=Home, CN=*.intranet.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:f2:a4:2c:56:3e:81:56:fc:78:44:cc:f2:25:31:
                    b9:56:3d:41:fa:76:5d:b6:e0:f1:8d:3b:d9:ba:f4:
                    2e:0b:90:2b:9c:69:05:f8:68:4d:d4:b3:97:e4:4b:
                    c5:82:14:18:38:27:ad:fb:0c:e9:fe:cc:03:ed:49:
                    27:a0:f1:c7:00:a3:95:70:e9:9a:be:1e:55:3f:2c:
                    af:d8:e2:a8:1c:28:29:13:2f:b0:41:2c:66:b8:c8:
                    db:5b:c3:1e:51:bc:f7:53:59:4d:c9:14:42:7b:46:
                    08:d8:c1:78:5f:cc:92:3d:0c:4d:1e:bc:59:93:86:
                    0d:41:6f:2b:2e:00:57:ca:b0:a9:8f:ed:6b:f8:95:
                    d0:5b:f8:da:63:db:e9:05:24:2f:f7:e4:b2:b4:f7:
                    29:25:77:96:fe:56:18:ab:e9:72:68:b3:7e:eb:6d:
                    23:ad:63:5c:f5:77:65:42:e6:bf:9c:31:06:65:f0:
                    59:eb:03:70:c1:00:29:5e:90:9b:6a:c5:34:c6:a5:
                    bf:77:f9:a9:ae:c0:dc:68:41:45:4e:e1:d3:73:be:
                    bd:a1:02:ce:bb:2b:e5:55:19:1f:10:93:64:84:4f:
                    39:d0:86:d0:b4:cc:f4:66:2f:52:2f:44:9a:31:91:
                    05:69:b0:14:4f:e5:19:a1:c3:c5:3a:33:f1:5f:e5:
                    9a:87
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:jira.intranet.com, DNS:www.jira.intranet.com
    Signature Algorithm: sha256WithRSAEncryption
         20:d4:28:f2:aa:84:83:f2:f9:20:06:0b:1d:2d:cd:d6:ef:d6:
         9c:66:fa:55:af:f9:b0:c7:db:06:f7:ff:8d:b6:31:b5:35:03:
         36:59:93:59:f1:79:3a:f8:be:6a:6a:21:d1:9f:5c:a3:b4:95:
         34:02:22:e9:8b:ba:ac:7e:dd:68:73:17:d3:0d:c8:3f:c2:25:
         f9:d8:f0:70:7f:25:5f:cf:6b:84:fd:fe:8b:b0:77:44:4c:0c:
         cf:a4:83:35:75:df:3b:46:bd:c0:83:bf:9b:cc:39:fd:69:74:
         14:02:1b:c0:92:7f:c7:a0:fe:d2:48:03:04:f5:93:41:77:a2:
         e9:b5:fa:c4:f3:79:85:06:4b:55:71:31:29:b1:48:59:20:9e:
         1b:c6:08:e8:f0:12:8c:8c:f8:67:02:31:fc:31:5f:76:93:f0:
         0e:8f:d2:75:f6:77:42:60:8b:5a:c9:60:33:39:f7:01:0a:09:
         1a:ff:3b:94:33:4b:d1:9d:49:b2:63:7d:1d:d0:55:4c:db:8c:
         56:65:b5:7f:50:16:ee:ab:05:66:3b:75:7f:80:2c:94:00:1e:
         04:39:75:a7:81:89:6c:a0:37:ca:22:a3:7c:95:29:57:b2:b4:
         b4:a9:6c:ab:77:81:7d:c3:20:d5:57:43:73:29:b7:e1:ee:6c:
         a3:b0:5f:98

If I visit jira.intranet.com on OS X, view certificate, drag certificate to desktop, import to OS X KeyChain and change Trust Settings to 'Trust All' then I can visit the site and it is marked as secure, as per below screenshots.

OS X Google Chrome Using Self-Signed Certificate

If I now visit jira.intranet.com in google chrome but this time on windows, I am presented with the below screen, complaining of ERR_CERT_AUTHORITY_INVALID.

Windows Google Chrome first visit

I expected this, as in OS X I expected I will need to add the certificate to be trusted on this device. However, I noticed it is reporting 'Windows does not have enough information to verify this certificate'. This I believe is my main issue, and I'm not sure how to address it.

I continued to add the same certificate I used in OS X KeyChain to Windows 'Trusted Root Certificate Authorities' with certmgr.msc.

Adding Certificate to Trusted Root Certificate Authorities

This did not resolve my issue, screenshot below.

Google Chrome / Windows not accepting certificate

So, I am unable to access my site on windows as 'Secure' when I can on OS X. I believe its something to do with the process I have used to create the certificate, but I am no expert in certificates and am unsure how to proceed.

Any help in this would be greatly appreciated.

0

Well, managed to get it working with below line to create the certificate.

openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout server.key -out server.crt -subj "/C=UK/ST=State/L=Locality/O=Home/OU=IT/CN=jira.intranet.com" -reqexts SAN -extensions SAN -config <(cat /etc/pki/tls/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:jira.intranet.com,DNS:www.jira.intranet.com"))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.