Chrome NET :: ERR_CERT_AUTHORITY_INVALID在LocalHost自签名证书上的错误

Question

我想在本地PC上设置开发环境。由于生产网站支持HTTPS（谁最近没有？），我想在本地主机上也有这个功能。我认为这很容易，但没有。

我有一个XAMP安装，并设置所有我可以访问该网站。但是，每当我去任何网页的网站在本地，我得到的铬警告：

NET :: ERR_CERT_AUTHORITY_INVALID

我的确遵循了以下线程试图解决这个问题：

Getting Chrome to accept self-signed localhost certificate

我还创建了证书与正确的主题备用名称（SAN）段，在此基础上：

https://deliciousbrains.com/https-locally-without-browser-privacy-errors/

之后，我生成了CER或P7B文件并将其导入Chrome。我重新启动了Apache和Chrome。

我将证书放入受信任的根证书颁发机构。不知何故，然而铬决定将其放置在中间根证书颁发机构...

我使用Chrome 61，我有同样的60

所以不知何故，我无法安装自签名证书，并继续得到这个警告，基本上使本地主机上的开发不可能...

我明白，这种自签名不完全值得信赖，但必须有一种方式离线开发？从现在开始，我们不得不在网上建立网站吗？...

任何想法？

Answer 1

我修正了我在this之后的完全相同的问题。

问题似乎是证书的创建方式。

下面的代码是来自上述的网站。

#!/usr/bin/env bash 
mkdir ~/ssl/ 
openssl genrsa -des3 -out ~/ssl/rootCA.key 2048 
openssl req -x509 -new -nodes -key ~/ssl/rootCA.key -sha256 -days 1024 -out ~/ssl/rootCA.pem 


#!/usr/bin/env bash 
sudo openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config <(cat server.csr.cnf) 

sudo openssl x509 -req -in server.csr -CA ~/ssl/rootCA.pem -CAkey ~/ssl/rootCA.key -CAcreateserial -out server.crt -days 500 -sha256 -extfile v3.ext 

server.csr.cnf文件

[req] 
default_bits = 2048 
prompt = no 
default_md = sha256 
distinguished_name = dn 

[dn] 
C=US 
ST=New York 
L=Rochester 
O=End Point 
OU=Testing Domain 
[email protected]omain.com 
CN = localhost 

v3.ext文件

authorityKeyIdentifier=keyid,issuer 
basicConstraints=CA:FALSE 
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment 
subjectAltName = @alt_names 

[alt_names] 
DNS.1 = localhost 

Answer 2

有一个伟大的图形用户界面基于Java的工具，我使用的创建和处理所有的事情PKI称为KeyStore Explorer。因此，比所有的命令行选项更容易：

http://keystore-explorer.org/

Answer 3

下面是使用密钥库资源管理器工具我的指示。

的两件事情，当我创建的证书我以前缺少的是：

• AKID（权威密钥识别） - 选择相同的“CN =”在创建时使用。
• 添加在“基本约束”选项（不要选择“是CA”）

没有那些两件事情的Chrome甚至会发出警告/错误时，你已经安装了自签名证书到您的MS -CAPI PKI信任存储（为“受信任的根机构）。

下面是我使用的步骤。

Instructions using KSE (KeyStore Explorer) 
Create a JKS 
Creating a self-signed certificate 
Open KeyStore Explorer 
File | New | JKS | OK 
Create a Password for your JKS file 
File | Save as... | enter your password 
Enter file name | OK 
Tools | Generate Key Pair 
Select Algorithm and Key Size (i.e. 2048) | OK 
Select validity period (i.e. 5 years) 
Select Name (Book icon) | Enter in Name fields | OK 
I.e. “CN=localhost…<or SERVER_NAME>” 
Add Extensions (Very Important), this determines what type of certificate it will be and how it can be used. This example will be for a standard server certificate with SSL. 
Add in the Key Usage item 
Add in the Digital Signature and Key Encipherment options checkbox 
Add in the EKU (Extended Key Usage) options 
Select both of these options: 
TLS Web Client Authentication 
TLS Web Server Authentication 
Add in the SANs (Subject Alternative Name) 
Add in all the needed DNS names and IP Addresses (if applicable) for which this server will be used. (repeat for all desired values) (e.g. 127.0.0.1 and localhost (or <SERVER_NAME>) 
It will look something like this when it's done 
When it's done you will see all the fields with the OIDs (Object Identifiers) listed | OK | OK 
Add in the AKID (Authority Key Identifier) 
Add Extensions "+" 
Add Extension Type | Authority Key Identifier 
Select the Authority Cert Issuer of the CN that you created above (.e.g "CN=localhost...") | OK 
Add in a "Basic Constraints" (do NOT check "Subject is a CA") 
When you're done you'll see these listed: hit "OK" 
Note: the Basic Constraints and AKID (Authority Key Identifer) are needed for the Chrome Browser to validate the self-signed certificate as a trusted certificate. 
Otherwise you'll see warning or error messages even after you have add this certificate, explicitly, to your MS-CAPI Trusted Root certificates. 
Enter in the Alias of the keypair name you want to use 
Enter in the private keypair password 
*Note: this password MUST be the same as the JKS file keystore password or Java may fail silently when trying to use this certificate. 
You should see a message indicating success. | OK 
Then, save the File | Save