up vote 7 down vote favorite
3
share [g+] share [fb]

I have a problem with a website that has an SSL certificate which doesn't correspond to the website domain. Chrome gives me a warning for this website (and rightly so), which I have to ignore manually. Every time I restart Chrome, I need to ignore the certificate issue again.

I've tried adding the certificate as a trusted one with certutil, using C,, and P,, trustargs, but it doesn't work. I can't find a set of trustargs that will tell it to ignore which domain is using the certificate.

Is there a way to tell Chrome (or certutil) to trust this certificate whatever domain uses it?

link|improve this question
89% accept rate
feedback

4 Answers

up vote 3 down vote

Please have a look at this thread:
Can't convince Chrome that my Tivo's self signed certificate is ok.

The article remarks that:

You need to specify the "C,," trust flags to work around the NSS bug.

If this thread does relate to your problem, it looks like this is a known bug in Chrome, where the "P,," trust flags is not working: libpkix ignores the P (trusted peer) trust flag

I hope this helps (I'm answering a bit blindly, since I'm not on Linux).

link|improve this answer
Thanks, it seems to be related to my problem, and hence a bug in Chrome. I'll consider your suggestion as an answer to my question, even though it doesn't really fix my problem :-) – Raphink Feb 15 '10 at 9:23
feedback
up vote 3 down vote

This is a summary of the answers from the thread
Disable Google Chrome warning if security certificate is not trusted.

You can avoid the message for trusted sites by installing the certificate.
This can be done by clicking on the warning icon in the address bar, then click
Certificate Information -> Details Tab -> Export...
Save the certificate.

Use Chrome's Preferences -> Under The Hood -> Manage Certificates -> Import.
On the "Certificate Store" screen of the import, choose "Place all certificates in the following store" and browse for "Trusted Root Certification Authorities." Restart Chrome.

link|improve this answer
Thank you, but this only works on Windows. On Linux, Chrome uses the certutil command line tool to manage certificates, nothing else. – Raphink Feb 11 '10 at 11:30
It seems I can't select your answer as the right one anymore because the bounty expired :'( – Raphink Feb 15 '10 at 9:24
@Raphink: Does this work after all in Linux? – harrymc Feb 15 '10 at 9:28
(And I believe the bounty can be relaunched.) – harrymc Feb 15 '10 at 9:30
No, it doesn't work on Linux, and the bounty cannot be relaunched. – Raphink Feb 22 '10 at 9:43
show 1 more comment
feedback
up vote 2 down vote

Google Chrome in Linux doesn’t have a SSL certificate manager, it relies on the NSS Shared DB. In order to add SSL certificates to the database you will have to use the command line. I will explain how you can add the CAcert certificates and a very easy way to add self-signed certificates.

Please have a look at this thread: blog.avirtualhome.com/2010/02/02/adding-ssl-certificates-to-google-chrome-linux-ubuntu/

link|improve this answer
Thank you k din. The script worked fine for me. – Flow Dec 11 '11 at 13:02
feedback
up vote 1 down vote

Have you tried using the trusttags "TCP,,"?

link|improve this answer
Yes, it doesn't work. By the way, P is overriden by C, so it ends up being equivalent to TC. – Raphink Feb 3 '10 at 11:13
Ah, you're right, P is not necessary here. Hmm... I can't think of anything else, sorry... – Attila O. Feb 4 '10 at 12:35
Thanks for suggesting Attila. – Raphink Feb 6 '10 at 20:47
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.