28

I'm trying to always trust a self signed certificate but I'm having issues.

For one, when I try to drag the certificate to a folder or desktop, it just doesn't do anything. I can do the same from safari to save the certificate, but not chrome.

And when I dragged that certificate to keychain access, added it, and trusted it, it worked in safari after that. But still not chrome.

How can I get a cert from chrome and have it always be trusted on macOS 10.13?

Improve this question
1
  • I think it depends on the User Agent. A command line tool, like curl, openssl and wget, will root trust in a self signed certificate. However, I believe some browsers, like Chrome and Firefox, generally require you to root trust in a CA certificate. (And then the CA certificate would issue a end-entity/server certificate for the domain).
    – jww
    Commented Oct 6, 2018 at 12:03

3 Answers 3

Reset to default
22

From your description, it seems to me that you have installed the certificate as a simple X.509 certificate, but have not set it to be trusted for SSL.

To do that, from the keychain, reopen the certificate, expand the Trust section, and change the SSL setting to "Always Trust"

image

Close the dialog to save the changes (you’ll be prompted for your password again). If you refresh the browser window you should see the happy green lock:

image2

If you don’t see the green lock, just restart Chrome or type chrome://restart into the address bar.

Improve this answer
5
  • 1
    I know how to trust it once I have the cert, but the issue is Chrome won't save the cert. I drag it into keychain access, finder, something, and just... nothing happens.
    – cclloyd
    Commented Sep 30, 2018 at 21:46
  • Here is a complete article about the procedure. Please add to your what you exactly you did and whether the results look like the screenshots in the article.
    – harrymc
    Commented Oct 1, 2018 at 7:53
  • When I try to drag the certificate anywhere (desktop, downloads, keychain access), nothing happens.
    – cclloyd
    Commented Oct 1, 2018 at 8:06
  • It looks to me like something is wrong with it. Try to explicitly open it with a utility to see if it gives an error message.
    – harrymc
    Commented Oct 1, 2018 at 8:09
  • I am on Catalina 10.15.5 - a reboot of the system was required before Chrome would "trust" the certificate, and the site displays as Not Secure - but I don't get blocked.
    – Roy Hinkley
    Commented Jul 15, 2020 at 14:43
3

To troubleshoot this kind of problem, open Developer Tools, go to Security tab, and you will see why Chrome deems the certificate invalid.

It is likely to be due to its lack of subjectAltName extension.

You can remedy this by following these steps: https://stackoverflow.com/a/56530824/2873507

Improve this answer
1

You could directly download the certificate in Chrome by a less than intuitive operation: Grab the certificate image and drag it to your desktop. Then add that file to your Keychain->System->certificate. (or directly drag it there).

  • Note there is no 'copy to file' button(as some old solutions stated[1, 2]) in the latest Chrome now:

  • No Chrome restart is needed.

  • After this step, you may still encounter 'its security certificate does not specify Subject Alternative Names.' But you could 'proceed to yourURL(unsafe)' screenshot

Improve this answer
1
  • 1
    Welcome to SuperUser! Please do not only provide links to other tutorials on how to do something but quote the most important parts as contention the internet might change. As soon as the linked site changes/goes down, your answer would be obsolete.
    – DarkDiamond
    Commented Jan 22, 2022 at 0:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .