8

Could anyone suggest a modern way of generating self-signed certificates to be implemented on localhost, which would be accepted by Chrome and Mozilla?

I tried the openssl generation, however Mozilla complains that the issuer is untrusted.

Centos 7, nginx

  • Use Let's Encrypt. – Thomas Jul 30 '17 at 18:41
  • 2
    It's local domain, Let's encrypt works only on registered – Tarlan Mammadzada Jul 30 '17 at 18:44
  • 2
    Navigate to the site, click advanced, and click add exception. – Richard Smith Jul 30 '17 at 19:56
  • 1
    You want it to appear secure, you will need a self-signed CA and use it to sign your server's certificate, then you can add the CA to the browser's trust store. – Richard Smith Jul 30 '17 at 20:00
  • 1
    It seems that Firefox has stopped accepting self-signed certificates. As @RichardSmith says, you'll need to use a Certification Authority to generate your certificates. Before you dive into that minefield, you may need to study the security implications of operating your own Authority. – garethTheRed Jul 30 '17 at 20:27
7

Warning: Before you dive into the minefield of running your own Certification Authority, you may need to study the security implications!

But if you must, read on for a quick and dirty CA that will give you https://localhost/ without a warning message...

Create the following text file:

# OpenSSL configuration for Root CA

[ req ]

prompt             = no
string_mask        = default

# The size of the keys in bits:
default_bits       = 2048
distinguished_name = req_distinguished_name
x509_extensions    = x509_ext

[ req_distinguished_name ]

# Note that the following are in 'reverse order' to what you'd expect to see.

countryName = gb
organizationName = Test
commonName = Test Root CA

[ x509_ext ]

basicConstraints=critical,CA:true,pathlen:0
keyUsage=critical,keyCertSign,cRLSign

Save as root.cnf then generate the request with:

$ openssl req -x509 -new -keyout root.key -out root.cer -config root.cnf

This will create your Root CA certificate (root.cer) and your Root CA private key (root.key) which you must keep private. It will prompt for a password for the private key - ensure you choose a strong one.

Now create a config file for the server certificate:

# OpenSSL configuration for end-entity cert

[ req ]

prompt             = no
string_mask        = default

# The size of the keys in bits:
default_bits       = 2048
distinguished_name = req_distinguished_name

x509_extensions    = x509_ext

[ req_distinguished_name ]

# Note that the following are in 'reverse order' to what you'd expect to see.

countryName = gb
organizationName = Test
commonName = localhost

[ x509_ext ]

keyUsage=critical,digitalSignature,keyAgreement

subjectAltName = @alt_names

# Multiple Alternate Names are possible
[alt_names]
DNS.1 = localhost
# DNS.2 = altName.example.com

Save it as server.cnf and generate the request with:

openssl req -nodes -new -keyout server.key -out server.csr -config server.cnf

The above will generate another private key (server.key) which you must protect. In this case, the key is not password protected, but you may add a password by removing the -nodes option.

Finally, sign the request with your new Root CA and extensions from the server.cnf file (for convenience):

$ openssl x509 -req -in server.csr -CA root.cer -CAkey root.key -set_serial 123 -out server.cer -extfile server.cnf -extensions x509_ext

Note: pick any random number for the -set_serial option.

It will ask for the password you entered when you generated the Root CA.

A server certificate (server.cer) will be generated.

Now, add the Root CA certificate (root.cer) to Firefox's trust-anchor store and run a test with:

$ sudo openssl s_server -key server.key -cert server.cer -accept 443 -www

Note: You may get errors if you already have a sever running on port 443. In which case, either stop the running server or change the port number above to another unused port.

When you naviate to https://localhost (or https://localhost:<port> if you changed the port number above) with Firefox, you should now see no warning and be presented with a list of ciphers your installation of OpenSSL can offer.

Once you're happy with the results, add the server.key and server.cer to your webserver and configure accordingly.

  • 1
    There's a typo; stinguished_name should be distinguished_name – user281357 Mar 18 '18 at 16:33

protected by Community May 8 '18 at 11:31

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.