View source for Openssl - Generate Self-signed Certificate for Chrome


== Introduction==

After the release of Google Chrome 58, self-signed certificates were no longer working in Chrome as they once did. Google started enforcing new security rules and this made Chrome consider many certificates invalid.

In my case, the problems I encountered were:
* The Subject Common Name was invalid <code>NET::ERR_COMMON_CERT_INVALID</code>
* The cert did not have a Subject Alternative Name <code>Developer tools said "Subject Alternative Name Missing"</code>
* The cert used a weak algorithm <code>NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM</code>
* Importing a cert into Chrome as a <i>server</i> certificate no longer worked


__TOC__

=== Why is this a problem? ===
I access my personal servers a lot, and I use self-signed certificates. Before Chrome 58, I could import the certificate as a server cert, and this would bypass the SSL error screen and would display a secure lock icon with green text on the address bar. This saved me the time of clicking through the error, but the lock icon also told me that I'm accessing my server. If someone man-in-the-middle attacked me I would get a certificate error, thus giving me a blatant indicator that something is wrong.

I searched a long time for a solution, but I abandoned the effort for a while. For about 6 months, I was seeing an SSL error every time I accessed my servers. Now since I see an SSL error all the time, if someone attacked me I wouldn't notice. "Thanks Google...", I thought, "...for making your browser more secure for everyone except me." I can't complain about them adding security features, but not providing any guides or documentation that helps the average Joe Techie generate valid self-signed certificates, it's just cruel.

The following section describes the process that worked for me.

<i>Note: I'm using OpenSSL 1.1.0g 2 Nov 2017</i>

== Generating an RSA Key ==

The rest of this tutorial assumes you already have an RSA key. If you don't already have a key, the following command will generate a new 2048 bit RSA key that is not locked with a password (so your web server can start without human intervention).

<source lang="shell">
openssl genrsa -out server.key 2048
</source>

== Generating a CA Cert ==

I'm assuming you're using openssl on Linux (or MacOS) in this tutorial. I've simplified things using a bash script, but if you're doing this on a Windows platform, you can simply create a custom <code>openssl.cnf</code> file that has the added lines that I create in my script.

In my case, I'm using this cert for my Apache server. I'm going to backup my old certificates, <code>cd</code> into the folder where I keep the certs, and create a shell script (do these steps as root):
<source lang="shell">
cd /etc/apache2/
cp -r ssl ssl.orig
cd ssl
touch make-cert.sh
chmod u+x make-cert.sh
</source>

Before we continue, we need to understand some things.

=== Openssl Config File ===

Openssl uses a default config file called <code>openssl.cnf</code>. Different systems have this file in different locations. If you can't find it, search for it:
<source lang="shell">
find / -type f -name openssl.cnf
</source>

Replace the <b>ssl_config</b> variable in the [[#thescript|bash script]] below with the correct <code>openssl.cnf</code> file location for your system. 

If you take a look at the contents of <code>openssl.cnf</code> you will see a section like this:
<source lang="shell">
[ v3_ca ]

# ..several comments..

subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
</source>

This is the magic that makes our cert a CA cert. We can add this as an extension, but we are going to create a custom version of v3_ca so we can include multiple Subject Alternative Names.

=== Organization Name ===

Notice in the script below that I've chosen "AAA" as the Organization Name (/O=AAA) and Organizational Unit (/OU=AAA). This was just to make the cert appear at the top of the cert list in Chrome. It was faster for troubleshooting. You can choose any name you want.

=== Common Name ===

Your Subject Common Name (/CN=name) needs to be valid. Chrome no longer considers a simple hostname a valid CN. You need to include a domain name. In my example, because I'm using this cert for accessing my server from my local network (I use a different cert for public access), it's sufficient to use <code>server.mydomain.local</code>.

=== Alternative Names ===

Notice the <code>[&nbsp;v3_ca_with_san&nbsp;]</code> extension I created (below) is slightly modified, and includes the <code>subjectAltName</code> value which refers to another custom extension that I named <code>[&nbsp;alt_names&nbsp;]</code>. The <code>[&nbsp;alt_names&nbsp;]</code> extension then defines several DNS names. You <b>must</b> include the Common Name (ie. server.mydomain.local) as an Alternative Name. After that you can add any other alternative names you want, and even IP addresses. Be sure to number them as seen below.

=== Hash Algorithm ===

Lastly, we are including the <code>-sha256</code> parameter to the <code>openssl</code> command to ensure we are using the minimum strength hash algorithm that is accepted in Chrome. You could also use <code>-sha512</code>.

=== Checklist ===

You are almost ready to create your script. Here's a checklist of assumptions for this script:
* You already have a private key called <code>server.key</code>
* You want the output certificate to be saved to <code>server.crt</code>
* You've edited <b>ssl_config</b> variable in this script to the correct location of your <code>openssl.cnf</code> file on your system
* Your <b>Subject Common Name</b> is valid (must have domain name, ie. "server.mydomain.local")
* You've added all the <b>Alternative Names</b> you want to use
* You've edited/added organization name, email, etc. to reflect your needs

=== <span id="thescript"></span>The Script ===

Now edit the <code>make-cert.sh</code> script and add these contents (modify to meet your needs):
<source lang="shell">
#!/bin/bash
#
# Generate CA certificate from a pre-existing key that works with Chrome 58+.
#

input_key=server.key
output_crt=server.crt
ssl_config=/usr/lib/ssl/openssl.cnf

ssl_subj=$(cat <<EOF
/C=US
/ST=California
/L=SomeCity
/emailAddress=root@server.mydomain.local
/O=AAA
/OU=AAA
/CN=server.mydomain.local
EOF
)

ssl_custom=$(cat <<EOF
[ v3_ca_with_san ]
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = critical,CA:true
subjectAltName = @alt_names
[alt_names ]
DNS.1 = server
DNS.2 = www
DNS.3 = server.mydomain.local
DNS.4 = www.mydomain.local
IP.1  = 192.168.0.2
EOF
)

openssl req \
    -key "$input_key" \
    -x509 \
    -nodes \
    -new \
    -out "$output_crt" \
    -subj $(echo -n $ssl_subj|tr -d ' ') \
    -reqexts 'v3_ca_with_san' \
    -extensions 'v3_ca_with_san' \
    -config <(cat "$ssl_config" \
            <(printf "$ssl_custom")) \
    -sha256 \
    -days 10000

# Restart Apache. I did this for quick testing. You don't need to include this.
systemctl restart apache2

</source>

Read through this script to understand what it's doing. Now run the script:
<source>
./make-cert.sh
</source>

If there was no output, it likely completed successfully. There should be a <code>server.crt</code> file and your Apache server be restarted. You can now import the certificate into Chrome.

=== Concatenating the Key and Certificate ===

This is not necessary in most cases, but I've run into web applications that expect the key and the certificate to be contained in a single file (this does not cause the application to send the private key to end users). Simply combine them into one file with the key at the top.

<source lang="shell">
cp server.crt server.crt.orig
cat server.key server.crt.orig > server.crt
</source>

<i>Sometimes it's expected that the certificate file have a .pem extension instead of .crt, but usually either will work.</i>

== Importing the Certificate into Chrome ==

Open Chrome and navigate to your site via HTTPS (ie. <code><nowiki>https://server.mydomain.local</nowiki></code>). You will now see the following SSL error.

[[File:Ssl01.jpg|border]]


Open the Developer tool by pressing <b><code>F12</code></b> or <b><code>Shift + Ctrl + I</code></b>. Click the <b>Security</b> tab and click <b>View Certificate</b>.

[[File:Ssl02.jpg|border]]


In the Certificate Viewer click the <b>Details</b> tab. Look through the details to make sure you are, in fact, recieving the correct certificate. Click the <b>Export...</b> button at the bottom.

[[File:Ssl03.jpg|border]]


Save the file as a <b>Base64-encoded ASCII, single certificate</b> and be sure to add a <b><code>.pem</code></b> extension to the file name. For some reason, Chrome doesn't export the cert with an extension, but when you import a cert it expects an extension. Logical, eh?

[[File:Ssl04.jpg|border]]


Go to the main menu in Chrome and click <b>Settings</b>. Scroll to the bottom and click <b>Advanced</b>. Under the <b>Privacy and Security</b> section click on <b>Manage Certificates</b>.

[[File:Ssl05.jpg|border]]


Click on the <b>Authorities</b> tab and click <b>IMPORT</b>. Locate the <code>server.mydomain.local.pem</code> file you exported and click <b>Open</b>.

[[File:Ssl06.jpg|border]]


Check all three boxes and click <b>Ok</b>. You should be able to scroll down the Authorities list and find your certificate in the list.

[[File:Ssl07.jpg|border]]


Close all Chrome windows and open it again. You should now be able to navigate to your site via HTTPS. No SSL errors and a nice, green lock icon. Success!!

[[File:Ssl08.jpg|border]]

== Importing the Certificate into Android ==

I found that Chrome on Android does not have the option to export a certificate the same way as before. Also, you don't import the cert into the browser, you import it into the operating system's credential storage. Also consider that some Android devices are different, so your process may differ from mine.


First, download the certificate to your SD card. I just attached my phone via USB to my computer and transferred the PEM file.

Go to <b>Settings</b> and click on the <b>General</b> tab. Then click on <b>Security</b>.

[[File:Ssl09.png|border|300px]]


Go to <b>Certificate Management</b> and click on <b>Install from Storage</b>.

[[File:Ssl10.png|border|300px]]


Locate the cert file you saved and click it. You will be asked to confirm your PIN (or lock pattern, fingerprint, etc.).

[[File:Ssl11.png|border|300px]]


Now enter your <b>Certificate name</b>. This is just a superficial name; I used the server name. Everything else you can leave as it is. Now click <b>Ok</b>.

[[File:Ssl12.png|border|300px]]


You should now be able to open your browser (close any existing tabs) and navigate to your server via HTTPS without any SSL errors.