Recently, Chrome has stopped working with my self signed SSL certs, and thinks they're insecure. When I look at the cert in the DevTools | Security
tab, I can see that it says
Subject Alternative Name Missing The certificate for this site does
not contain a Subject Alternative Name extension containing a domain
name or IP address.Certificate Error There are issues with the site's certificate chain
(net::ERR_CERT_COMMON_NAME_INVALID).
How can I fix this?
Best Answer
To fix this, you need to supply an extra parameter to
openssl
when you're creating the cert, basically-sha256 -extfile v3.ext
where
v3.ext
is a file like so, with%%DOMAIN%%
replaced with the same name you use as yourCommon Name
. More info here and over here. Note that typically you'd set theCommon Name
and%%DOMAIN%%
to the domain you're trying to generate a cert for. So if it waswww.mysupersite.com
, then you'd use that for both.v3.ext
Note: Scripts that address this issue, and create fully trusted ssl certs for use in Chrome, Safari and from Java clients can be found here
Another note: If all you're trying to do is stop chrome from throwing errors when viewing a self signed certificate, you can can tell Chrome to ignore all SSL errors for ALL sites by starting it with a special command line option, as detailed here on SuperUser