0

I followed this tutorial to simulate my own "CA": https://www.privux.de/certificate-authority/

The reason is, that I have a little server infrastructure with a lot of web-interfaces like dns interface, proxmox interface, firewall interface...etc. which are accessible via browser when I am connected with VPN.

So dns names like "dns.mydomain.intern" are available. But I don't like to click "Trust this site" every time.

So my idea was to create my own "ca" and import the root certificate on my mobile phone, laptop and my servers. With ansible it should be possible to deploy the certificate in a short time to all servers or is there a faster option like something with ldap? (I remember, microsoft has a solution for the domain controller - anything for linux available too?)

What is my problem? Very simple:

I've imported the root certificate to my windows computer and my android phone.

On Windows I imported the certificate with double-click on file and followed the instructions.

Also I have imported the file in the certificate window here: - Trusted Root Certification Authorities - Trusted publishers - CAs Info: I just translated that from my german pc - maybe it's called different on english.

On Microsoft Edge it's working fine - my certificate is valid and trusted. But on Chrome or Opera not. It's still untrusted and red. But when I click on info, to see certificate details it shows me, that the certificate is valid. What?!

On Android I added the certificate with click on the file and followed the instructions on my screen. But I also got this error (In Chrome and Edge).

Why? Is there any chance to get my sites trusted in chrome based browsers?

Thanks.

2
  • You haven't given any details of the certificates that you've created which makes it very difficult to figure out what's gone wrong. However, reading your linked article (with Google translate) shows that the issued certificate won't have a Subject Alternate Name which Chrome requires these days. Mar 26, 2019 at 8:52
  • Setting Subject Alternate Name was the solution. Thanks!
    – j0k4b0
    Mar 27, 2019 at 7:46

1 Answer 1

0

Other browsers than IE/Edge have their own certificate store. You either need to enable those browsers to use Microsoft's Certificate Store or you need to import your root CA to the browsers own certificate store.

If you created a sub CA (intermediate CA) then you need to make sure that the webserver sends the full chain (root ca + intermediate ca) to the client. Otherwise the client (browser) can not validate the certificate presented by the webserver.

1
  • Chrome uses the Windows' certificate store. Mar 26, 2019 at 8:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .