I generated a wildcard certificate for multiple (wildcard) domains (SANS, alternate domain names + IP) (see https://blog.flowl.info).
I imported the certificate into Firefox, Chrome and Windows certificate Storage. but when I visit one of my sites it still asks me wether to trust that cert or not (untrusted).
I expect Firefox/Chrome to trust a site when I imported the cert.
Where is the mistake?
I generated the cert this way:
openssl genrsa -out flowl-2014-2.key 4096 openssl req -new -out flowl-2014-2.csr -key flowl-2014-2.key -config openssl.conf openssl x509 -req -days 365 -in flowl-2014-2.csr -signkey flowl-2014-2.key -out flowl-2014-2.crt -extensions v3_req -extfile openssl.conf
[req] req_extensions = v3_req [v3_req] # Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = *.flowl.info #..... all the domains IP.1 = #...the ip(s)
I generated a
.p12 file of my keys/certs and imported that into Firefox, restarted, but it STILL shows my site as untrusted and asks to add an exception....
The self signed x509 cert isn't online anymore, I use a CA cert to sign my own cert now like suggested in the accepted answer. It seems a self-signed x509 wildcard cert cannot be imported into the browsers manually and permanently - I tried everything and always got a warning. It works with the CA signed cert now.