5

I've created a self-signed SSL certificate for local development. When accessing the page, I get a NET::ERR_CERT_AUTHORITY_INVALID error. But when I try to import it into Chrome (chrome://settings/certificates), it fails:

The file contained one certificate, which was not imported:

  • mylocalwebapp.dev: Not a Certification Authority

This is the command I've ran to create the certificate:

openssl req -new -x509 -nodes \
 -extensions SAN \
 -reqexts SAN  \
 -days 365 \
 -newkey rsa:2048 \
 -keyout /etc/ssl/private/apache-selfsigned.key \
 -out /etc/ssl/certs/apache-selfsigned.crt \
 -config <(cat /etc/ssl/openssl.cnf <(printf '[SAN]\nsubjectAltName=DNS:mylocalwebapp.dev'))

I've added the SAN-options because as of version 58, Chrome doesn't accept it without SAN. It worked on Chrome 57 and it still works on Firefox.

How can I get my self-signed certificate working on Chrome 58 on Ubuntu 17.04?

7

Just to make sure we're covering our bases... Have you tried the processes outlined here? https://stackoverflow.com/questions/7580508/getting-chrome-to-accept-self-signed-localhost-certificate

That used to work for me, but as of this morning, after updating to Chrome 58.0.3029.81, I also get the following error in the console for a self-signed cert that used to work on Ubuntu 16.04:

Certificate Error
There are issues with the site's certificate chain (net::ERR_CERT_AUTHORITY_INVALID).

EDIT:

I've just had success with one of the methods from the link I referenced above. It completely goes around Chrome because it seems like something has changed with Chrome and it's not working right anymore.

To dump the cert using OpenSSL client (probably not necessary, but in case you want to be very thorough):

$ echo QUIT | openssl s_client -connect $DOMAIN_TO_FETCH_FROM:443 | sed -ne '/BEGIN CERT/,/END CERT/p' > my-cert

To install the dumped cert using certutil. If you didn't dump your cert with openssl, replace my-cert with whatever filename is appropriate:

$ certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n my-cert -i my-cert

Check the installation of the cert with certutil (if you feel so inclined):

$ certutil -d sql:$HOME/.pki/nssdb -L

# Certificate Nickname                                         Trust Attributes
#                                                              SSL,S/MIME,JAR/XPI
#
# my-cert                                                      P,,  

Completely close and restart Chrome, and maybe you will find success. Worked for me on both 58 and 59-beta.

  • That's exactly my problem. It worked on Chrome 57, but as of 58 Chrome doesn't accept my certificate. Since you've got the same problem, you haven't got a solution either? – Stephan Vierkant Apr 20 '17 at 13:16
  • Nope, nothing yet. Going down a similar road in Firefox provides a different error that's maybe more informative for me "MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY", maybe there's something to that, but I don't know for sure. – tdg5 Apr 20 '17 at 13:26
  • If you run certutil -d sql:$HOME/.pki/nssdb -L do you see your self-signed cert listed? Mine shows up with "CT,C,C", which is the way I think it's supposed to show, but again, I don't know for sure. – tdg5 Apr 20 '17 at 13:27
  • 1
    No luck for me ... I see them listed but still can't add them to chrome – TheBakker Aug 3 '17 at 16:13
  • 1
    Working on Chrome 63. I just exported the certificate following the EXPORT part of this tutorial: stackoverflow.com/a/15076602/3194525 and then importing it with certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n my-cert -i my-cert – maaw Dec 19 '17 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.