4

I generated a wildcard certificate for multiple (wildcard) domains (SANS, alternate domain names + IP) (see https://blog.flowl.info).

enter image description here

I imported the certificate into Firefox, Chrome and Windows certificate Storage. but when I visit one of my sites it still asks me wether to trust that cert or not (untrusted).

I expect Firefox/Chrome to trust a site when I imported the cert.

Where is the mistake?

Update:

I generated the cert this way:

openssl genrsa -out flowl-2014-2.key 4096

openssl req -new -out flowl-2014-2.csr -key flowl-2014-2.key -config openssl.conf

openssl x509 -req -days 365 -in flowl-2014-2.csr -signkey flowl-2014-2.key -out flowl-2014-2.crt -extensions v3_req -extfile openssl.conf

With config:

[req]
req_extensions = v3_req

[v3_req]
# Extensions to add to a certificate request
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = *.flowl.info
#..... all the domains
IP.1 = #...the ip(s)

Update:

I generated a .p12 file of my keys/certs and imported that into Firefox, restarted, but it STILL shows my site as untrusted and asks to add an exception....

Update:

The self signed x509 cert isn't online anymore, I use a CA cert to sign my own cert now like suggested in the accepted answer. It seems a self-signed x509 wildcard cert cannot be imported into the browsers manually and permanently - I tried everything and always got a warning. It works with the CA signed cert now.

4
  • Dauerhaft = permanent
    – Daniel W.
    Jun 11, 2014 at 11:56
  • 1
    +1 for providing a real URL with a real certificate to look at.
    – jww
    Jun 12, 2014 at 7:04
  • "I imported the certificate into Firefox, Chrome and Windows certificate Storage. but when I visit one of my sites it still asks me wether to trust that cert or not (untrusted)." - what exactly, did you import? Did you import your CA (the issuer C=DE, ST=Hamburg, L=Hamburg, O=flowl.info, OU=flowl.info, CN=Daniel Wendler/[email protected])? Or was it the server certificate? If the server certificate, where exactly did you put it in Chrome?
    – jww
    Jun 12, 2014 at 7:07
  • @noloader I imported the x509 self signed certificate which is not active anymore, I'm now using my own CA cert like suggested in the answer below - this works with all browsers. I imported the same certificate manually which the browsers let me add automatically when I hit "download cert.. (add permanently).. continue anyways". In Chrome: Settings -> advanced settings -> certificates -> import.
    – Daniel W.
    Jun 12, 2014 at 7:30

1 Answer 1

1

what you can do is generate a self signed CA (Certification Authority), and then use it to sign a domain or more, even a starred domain (*.flowl.info).

I've done it for my server: https://dev.fouin.org/ (i have a Startcom for https://www.fouin.org, and all the other virtualhosts uses a *.fouin.org which i signed with my sefl signed AC).

hope it helps, even if it's not exactly what you asked.

1
  • It was a little bit trouble setting this up but it works like a charm, thank you!
    – Daniel W.
    Jun 11, 2014 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .