SSH into your server and follow below steps:
NOTE: I am logged in as root, so I haven't used SUDO.
-
$ openssl genrsa -out rootCA.key 2048
-
$ openssl rsa -in rootCA.key -out rootCA.key
-
Create a file san.cnf with following content
[ req ] default_bits=2048 prompt=no default_md=sha256 distinguished_name=req_distinguished_name [ req_distinguished_name ] C=AU ST=NSW L=Arncliffe O=Test Organization OU=IT [email protected] CN=localhost
-
$ openssl req -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem -config <(cat san.cnf)
-
$ openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout rootCA.key -config <(cat san.cnf)
-
Create a file v3.ext with following content
authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = @alt_names [alt_names] DNS.1 = local.dltr.org DNS.2 = cdn1.dltr.org DNS.3 = cdn2.dltr.org DNS.4 = cdn3.dltr.org DNS.5 = local.technooze.com DNS.6 = cdn1.technooze.com DNS.7 = cdn2.technooze.com DNS.8 = cdn3.technooze.com
-
$ openssl x509 -req -in rootCA.pem -signkey rootCA.key -out server.crt -days 1024 -sha256 -extfile v3.ext
-
$ cp rootCA.key /etc/ssl/private/
-
$ cp server.crt /etc/ssl/certs/
-
$ nano /etc/httpd/conf.d/ssl.conf
Then update these lines with new key and crt filenames:
SSLCertificateFile /etc/ssl/certs/server.crt SSLCertificateKeyFile /etc/ssl/private/rootCA.key
-
$ service httpd restart
-
goto chrome browser and enter chrome://restart
-
Visit your website and Press F12.
-
Click on 'Security' Tab on chrome's inspect window.
-
Click on 'View certificate' and then goto 'Details' tab on certificate window and make sure you can see "Subject Alternative Name"
-
Click on 'Copy to File' and follow Certificate Export Wizard and select "Cryptographic Message Syntax Standard -PKCS #7 Certificates (.P7B)" and tick "Include all certificates in the certification path if possible"
-
Once you save it as P7B file, type mmc on windows run command (windows + R)
-
Click on 'File' / 'Add/Remove Snap-in...'
-
Select 'Certificates' from Available snap-ins and then click 'Add'.
-
Select 'Computer Account' / Next / Local computer: (the computer this console is running on) / Finish / OK
-
Right click on 'Certificates' (which is under Console Root / Trusted Root Certification Authorities) and click on (All Tasks / 'import').
-
Follow Certificate Import Wizard and import PreviouslyExportedCertificate.P7B file.
Now restart your chrome browser again and once website reloads, check your localhost. You should have green https:// with a secure lock.
This Fixed Issues Related To:
- * Chrome: Invalid self signed SSL cert - Subject Alternative Name Missing
- * Getting Chrome to accept self-signed localhost certificate
- * Create self signed certificate with subjectAltName to fix [missing_subjectAltName] in Chrome 58+