1

I'm having an issue where Chrome raises NET::ERR_CERT_REVOKED for some sites signed by our internal self signed ca but not others. Can't figure out what's different. I am on MacOS Catalina so it sounds like superuser.com/questions/1492207/neterr-cert-revoked-in-chrome-chromium-introduced-with-macos-catalina but in my case my system is set to trust our internal ca and it works on several of our other internal sites. Obviously the internal cert that no one knows about can't possible be in a CRL. Firefox works fine and Safari complains because our Root CA is signed for 10 years. If that was the issue though Chrome shouldn't work on any of the internal sites. Here's a screenshot

3

Check these requirements:. https://support.apple.com/en-us/HT210176 Maybe one or to many of them are not matched?
You could also post Your cert chain to allow others to check it.

| improve this answer | |
  • And that's what it was. Apple changed the max time to 825 days and these certificates were all new. Chrome really should give a better error message though. Like hey this certificates are valid for too long. Safari tells you they don't match requirements anymore. – Shawn Oct 15 '19 at 21:11
  • Yes probably Apple introduced new return code for such cases (as Safari can tell a quite exact reason). Firefox ignores this (for now) and for Chrome a fall-back verification-handler kicks in that just forwards the "fatal" code to to user and behaves as such. – EOhm Oct 15 '19 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.