2

The Setup

In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL:

  • The Root CA Certificate
  • The Intermediate CA Certificate
  • The ca-chain file, containing the Intermediate CA but not the Root CA
  • The foo-server certificate
  • The bar-server certificate

I've bundled the chain and the certificates and configured one NGINX on foo-server and one APACHE on bar-server.

I've then installed the Root CA on my local Firefox and on my local Chrome.

Note that I've not used any SAN: for now, the certificates are issued for server names only (eg foo-server), NOT for their full names (eg. foo-server.ACME.local).

The Result

When I open https://foo-server/ and https://bar-server/,

On FIREFOX

Everything is OK. I see both of them secured (as it should be) because the server sends the chain properly, and I have the CA Root Certificate installed.

On CHROME

I get the following error on both of them, but the Common Names are perfectly fine:

NET::ERR_CERT_COMMON_NAME_INVALID

The Question

Since I'm really noob at this (I'm a Developer playing with SysAdmin toys), I would not be surprised to discover that the problem is something naive for you, but unknown to me.

What could be the culprit? What could I check? Maybe Chrome doesn't recognize a server name with no domain?

Andrea Ligios
  • 123
  • 4

1 Answers1

1

Chrome requires SAN present in the certificate.

papajony
  • 454
  • 2
  • 8
  • 1
    Why you ever need an intermediate CA in your scenario? For such simple scenario it is enough to have single root CA. Intermediate CA is useless here. – Crypt32 Oct 25 '18 at 15:07
  • Why would the intermediate cert be useless? Maybe ACME wants to stand up some automated server to process cert signing requests for renewing the server certificates when they expire, using the intermediate CA, but keeps the root CA on removable media under literal lock and key to prevent any intruders using it to run amok on the local network. Or some other scenario. There are plenty of reasons to use intermediate certs. – Ben Oct 25 '18 at 16:41