How to make browser accept a ssl certificate with a full certificate chain?

Question

I like to create my own PKI with a root CA and a intermediate CA finally signing a server certificate. For creation of the certificates I used openssl and got these:

cert.pem

ca_cert.pem:

root_cert.pem

Verifing these via openssl results in

.\openssl.exe verify -show_chain -CAfile root_cert.pem -untrusted ca_cert.pem cert.pem
cert.pem: OK
Chain:
depth=0: C = DE, ST = Niedersachsen, L = Osnabrueck, O = MyCompany GmbH, OU = Geschaeftsfuehrung, CN = localhost (untrusted)
depth=1: C = DE, ST = Niedersachsen, L = Osnabrueck, O = MyCompany GmbH, OU = Geschaeftsfuehrung, CN = MyCompany primary CA (untrusted)
depth=2: C = DE, ST = Niedersachsen, L = Osnabrueck, O = MyCompany GmbH, OU = Geschaeftsfuehrung, CN = MyCompany root CA

I also created a chain.pem file by concatinate all certs into it in the same order as listed above.

Now, I give the chain.pem to my Webserver as cert-file. I also added the root_cert.pem to my Operating System as trusted with this command.

PS> Import-Certificate -FilePath ./root_cert.pem -CertStoreLocation Cert:\LocalMachine\Root

Now opening the browser I got errors

Chrome says NET::ERR_CERT_COMMON_NAME_INVALID
FireFox says SEC_ERROR_UNKNOWN_ISSUER

If I click on show certificate, both browsers list the certificates above.

Unfortunately the browsers dont tell me the exact issues they have or give a hint how to solve them.

May I ask for help regarding my specific problem and also for a nice reference for what exactly is required to make a browser trust a server certificate created with a chain by yourself, so other people who encounter similar problems may find help? Thanks!

Remark: I only want to add the root_cert.pem as trusted to the operating system, and not any intermediate certificate.

score 0 · Accepted Answer · answered Dec 15 '22 at 08:30

In 2017 there was a change in how browsers check certificates for validity. Instead of using the common name (cn), they now use the subjectAltName. see also: heise

The subjectAltName is a extenstion to a certificate and needs to be added to it, continaing the DNS or IP of the host.

Hence it is an extension, it is not part of the subject standard of openssl. See here how to set the subjectAltName for openssl.

On top of that openssl has a known bug, that will prevent the transfer of the subjectAltName-extension on signing a request. You need to set it manually via a config file. CLI also not supported here. Find the solution here

FireFox send the mentioned error because it do not link to the operating system for Root-CA, you need to add it separately to FireFox.

Finally, if you encounter any problems of validity of your created certificate:

Use FireFox to check your https conncection, hence FireFox provide more detailed Error messages thon other browsers.
- dont forget to add your Root-CA to its dedicated cert-store.
Check Security & Signing Algorithms. They have to be up to date for all certificates!
Check for a correct subjectAltName to be present and valid (exactly the same value as in the reqeust URL).
Make sure your webserver sends not only its certificate, but the whole chain. Else there will be unknown issuer error, if you use a intermediate CA. See here

How to make browser accept a ssl certificate with a full certificate chain?

1 Answers1