0

I've got a Nginx server with SSL certificate signed by a my own CA (EIT-CA-G2) at https://ds-client.demo.e-it.nz

For some reason both my Chrome 61 and SSL Labs tester complain about name mismatch. Chrome says:

NET::ERR_CERT_COMMON_NAME_INVALID
Subject: ds-client.demo.e-it.nz
Issuer: EIT CA G2 Root
Expires on: 16 Oct 2022
Current date: 12 Oct 2017

while SSL Labs says:

 SSL Report: ds-client.demo.e-it.nz (52.62.59.234)
 Certificate name mismatch 
 Try these other domain names (extracted from the certificates):
 ds-client.demo.e-it.nz

Interestingly they don't complain about untrusted certificate but instead about name mismatch. I've got the CA Root imported in Chrome cert store, so it should be trusted anyway.

I can't spot any difference - the URL says ds-client.e-it.co.nz and the certificate says the same. What's wrong??

For the record Mozilla Firefox 56 opens the site without complains (also with the Root cert in its store).

Here are the site and the CA certs:

What's wrong with the certificate?

2

Your certificate is missing X509v3 Subject Alternative Name extension. Paradigm shifted at some point and CN is not used to verify host name anymore.

You can google for materials how to modify openssl configuration so it adds this extension to certificates.

  • That's it. With subjectAltName set it works as expected, thanks! – MLu Oct 12 '17 at 22:26
0

I see in your certificate this:

 CN=ds-client.demo.e-it.nz/emailAddress=hostmaster@enterpriseit.co.nz

and as far as I know it must be

 CN=ds-client.demo.e-it.nz

For me this is the reason of your problem

  • I have recreated the cert without emailAddress (and updated the files at the links) but it's still the same behaviour :( – MLu Oct 12 '17 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.