6

My company has an internal wiki and some QA sites that are all served by a machine with another name, so the url doesn't match the entity serving the certificate. I'm using Snow Leopard on a Mac. Firefox and Safari both are able to remember the certificate for future reference, but Chrome has no mechanism for doing so.

This is probably not the site you are looking for! You attempted to reach qablahblah1, but instead you actually reached a server identifying itself as qa.blahblah.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of qablahblah1. You should not proceed. (Buttons) "Proceed anyway" and "Back to safety"

In researching this I came across http://www.google.com/support/forum/p/Chrome/thread?tid=18ea33a150bbccd2&hl=en#fid_18ea33a150bbccd2000490771188d4c5 which suggested using Safari to "Trust" the certificate system wide. Leaving aside the wrongheadedness of having to use another browser to get a certificate saved so Chrome can see it, this doesn't even work.

I even tried setting up a local NSS Certificate DB and importing the certificates into it, but Chrome doesn't see them.

Can anybody suggest a method to force Chrome to remember my certificates when I return?

p.s. I also looked at How do add a certificate from a self-signed server to trusted certificates in Chrome? - but the answer there is so cryptic that I am forced to ask the question again.

2 Answers 2

2

As far as I know there is no method to automatically accept a certificate that is not appropriate for the system you are trying to reach.

In researching this I came across thread which suggested using Safari to "Trust" the certificate system wide.

That is un-related to your issue. That is about either a self-signed certificate, or a local CA. As for your complaint about using Safari, on Windows you could use IE. A design decision was made in Chrome to use the Certificate repositories from the host Operating system by default. The built-in browsers have better facilities to manage the system certificate stores.

3

You seem to be missing the point of Chrome's warning. Chrome isn't saying the certificate isn't trusted - it's saying it's for the wrong domain.

Even if you have a perfectly valid and trusted full certificate for www2.foo.com, that certificate won't work for www.foo.com (otherwise www.joeaverage.com could get an SSL cert and pretend to be www.gmail.com, and life would be bad).

The solution for you is to generate self-signed certificate for the domain you wish to secure, and then add that certificate to the Windows certificate store - Google Chrome uses the Windows certificate store to decide whether a certificate is trusted - and then you should be able to "securely" browse to your local domain without Chrome complaining.

5
  • 1
    I'm on a mac, so I question whether this will work for me.
    – barclay
    Dec 19, 2012 at 20:50
  • In which case, add it to the local certificates for your OSX system. Dec 20, 2012 at 9:49
  • This didn't work. It always asks again for the cert.
    – barclay
    Dec 20, 2012 at 20:35
  • Are you still getting the message "The cert is for X, but you are on Y?" You can only add valid certs to the store. You can't add certs that don't sign the domain you are visiting because the cert is invalid. Dec 20, 2012 at 23:02
  • 2
    And what if you don't have administrative access to the server in question? At my work there are several domains which are served by the same machine, but only one certificate.
    – Michael
    Jan 11, 2014 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .