I am trying to set up a single SSL certificate that will make any *.local website work over https. I have all .local domains pointing back to my local machine. I use these when developing websites. A lot of new features (geo location, service workers etc.) require an SSL.
I believe that for recent versions of Chrome/Firefox, an old school self-signed certificate no longer works.
Below are the steps I have taken after following a combination of these guides: https://deliciousbrains.com/https-locally-without-browser-privacy-errors/
Here is my config file:
#.................................. [ ca ] default_ca = CA_default [ CA_default ] dir = /home/*****/Sites/root-ca serial = $dir/serial database = $dir/index.txt new_certs_dir = $dir/certs certificate = $dir/certs/cacert.pem private_key = $dir/private/cakey.pem default_days = 3000 default_md = sha256 preserve = no email_in_dn = no nameopt = default_ca certopt = default_ca policy = policy_match copy_extensions = copyall [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] default_bits = 2048 # Size of keys default_keyfile = key.pem # name of generated keys default_md = md5 # message digest algorithm string_mask = nombstr # permitted characters distinguished_name = req_distinguished_name req_extensions = v3_req [ req_distinguished_name ] # Variable name Prompt string #------------------------- ---------------------------------- 0.organizationName = Organization Name (company) organizationalUnitName = Organizational Unit Name (department, division) emailAddress = Email Address emailAddress_max = 40 localityName = Locality Name (city, district) stateOrProvinceName = State or Province Name (full name) countryName = Country Name (2 letter code) countryName_min = 2 countryName_max = 2 commonName = Common Name (hostname, IP, or your name) commonName_max = 64 # Default values for the above, for consistency and less typing. # Variable name Value #------------------------ ------------------------------ 0.organizationName_default = ***** localityName_default = ***** stateOrProvinceName_default = ***** countryName_default = ***** emailAddress_default = ***** [ v3_ca ] basicConstraints = CA:TRUE subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always subjectAltName = @alternate_names [ v3_req ] subjectKeyIdentifier = hash basicConstraints = CA:FALSE keyUsage = digitalSignature, keyEncipherment subjectAltName = @alternate_names nsComment = "OpenSSL Generated Certificate" [ alternate_names ] DNS.1 = *.local
I first create a new certificate authority:
openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out certs/cacert.pem -days 3000 -config conf/caconfig.cnf
I have given the Common name here as my name
Common Name (hostname, IP, or your name) :Jonathan Hodgson
certs/cacert.pem I then import into chromium's authorities which works without a problem.
I then create a certificate request:
openssl req -extensions v3_req -new -nodes -out local.req.pem -keyout private/local.key.pem -config conf/caconfig.cnf
I have given the Common name here as *.local
Common Name (hostname, IP, or your name) :*.local
I then sign the request:
openssl ca -out certs/local.cert.pem -config conf/caconfig.cnf -infiles local.req.pem
I add the files to my http config:
<VirtualHost *:80> ServerName test.local ServerAlias *.local VirtualDocumentRoot /home/jonathan/Sites/%-2/public_html CustomLog /home/jonathan/Sites/access.log vhost_combined ErrorLog /home/jonathan/Sites/error.log </VirtualHost> <VirtualHost *:443> ServerName test.local ServerAlias *.local VirtualDocumentRoot /home/jonathan/Sites/%-2/public_html CustomLog /home/jonathan/Sites/access.log vhost_combined ErrorLog /home/jonathan/Sites/error.log SSLEngine On SSLCertificateFile /home/jonathan/Sites/root-ca/certs/local.cert.pem SSLCertificateKeyFile /home/jonathan/Sites/root-ca/private/local.key.pem </VirtualHost>
I have restarted apache but I am still getting
I was under the impression that this was because I needed to add the subjectAltName to the config file which I have done.
Please let me know what I should do differently.
Thanks in advance for any help
I think the problem is to do with the wildcard. If I set the alternate_names to example.local and the Common name for the request to example.local, example.local shows as secure in both Chrome and Firefox.
I tried to set DNS.1 to
local and DNS.2 to
*.local, I then just got
ERR_SSL_SERVER_CERT_BAD_FORMAT in chrome and
SEC_ERROR_REUSED_ISSUER_AND_SERIAL in firefox. I definitely reset my serial file and my index file before generating the certificates.