Getting Chrome to accept self-signed localhost certificate [closed]

Question

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store under Trusted Roots. Even though the certificate is listed as correctly installed when I click "View certificate information" in Chrome's HTTPS popup, it still insists the certificate cannot be trusted.

What am I supposed to do to get Chrome to accept the certificate and stop complaining about it?

Deas

When you say Firefox complains about it initially, do you mean that it asks you to add a certificate exception? This shouldn't happen if the certificate is correctly installed. It sounds to me that all three browsers are complaining, but Firefox allows you to cancel its complaint. I'm posting this as a comment as I don't have a specific answer, but I have done exactly this and it works fine in all three browsers. I would suggest that you try and get it working on IE first, and then once that is happy worry about the other two. Sorry I couldn't be of more help! – Mueller

Well, I added the Firefox exception before I added the certificate to the Windows system repository, so I don't know whether Firefox would've complained if I had done it the other way around or not, sorry. – Deas

You have to create a well formed certificate, including the way DNS names are presented. OpenSSL does not present them in a way that satisfies the browsers out-of-the-box. See How to create a self-signed certificate with openssl?. – Sosna

Firefox does not use the system certificate store. – Pulley

If your cert's signature uses SHA-1, recent versions of Chrome (circa 57) will display warnings even if you've been able to add your custom cert successfully. Regardless, the "Security" panel of the developer tools will say more specifically what the problem is e.g.: net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM. – Epicardium

Type thisisunsafe in chrome. This has been changed – Azeotrope

This is specific to dotnet core self signed certs try cleaning the older developer certs with dotnet dev-certs https --clean then create a new dev cert dotnet dev-certs https --trust see github.com/aspnet/AspNetCore/issues/8952#issuecomment-493429337 – Lepage

Answer 1

With only 5 openssl commands, you can accomplish this.

(Please don't change your browser security settings.)

With the following code, you can (1) become your own CA, (2) then sign your SSL certificate as a CA. (3) Then import the CA certificate (not the SSL certificate, which goes onto your server) into Chrome/Chromium. (Yes, this works even on Linux.)

You can just copy the code below into a new file (generate_certs.sh for example), update the variable NAME and the DNS.2 and IP.1 and save the file. Make it executable (chmod +x generate_certs.sh) and run it and that is it. You will have at the end the myCA.pem, $NAME.crt, and $NAME.key generated for you.

NB: For Windows, some reports say that openssl must be run with winpty to avoid a crash.

######################
# Become a Certificate Authority
######################

# Generate private key
openssl genrsa -des3 -out myCA.key 2048
# Generate root certificate
openssl req -x509 -new -nodes -key myCA.key -sha256 -days 825 -out myCA.pem

######################
# Create CA-signed certs
######################

NAME=mydomain.example # Use your own domain name
# Generate a private key
openssl genrsa -out $NAME.key 2048
# Create a certificate-signing request
openssl req -new -key $NAME.key -out $NAME.csr
# Create a config file for the extensions
>$NAME.ext cat <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = $NAME # Be sure to include the domain name here because Common Name is not so commonly honoured by itself
DNS.2 = bar.$NAME # Optionally, add additional domains (I've added a subdomain here)
IP.1 = 192.168.0.13 # Optionally, add an IP address (if the connection which you have planned requires it)
EOF
# Create the signed certificate
openssl x509 -req -in $NAME.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial \
-out $NAME.crt -days 825 -sha256 -extfile $NAME.ext

Recap

1. Become a CA.
2. Sign your certificate using your CA cert+key.
3. Import myCA.pem as an "Authority" (not into "Your Certificates") in your Chrome settings (Settings > Manage certificates > Authorities > Import).
4. Use the $NAME.crt and $NAME.key files in your server.

You can check your work to ensure that the certificate is built correctly:

openssl verify -CAfile myCA.pem -verify_hostname bar.mydomain.example mydomain.example.crt

Extra steps for Mac

1. Import the CA cert at "File > Import file", then also find it in the list, right click it, expand "> Trust", and select "Always"
2. Add extendedKeyUsage=serverAuth,clientAuth below basicConstraints=CA:FALSE, and make sure you set the "CommonName" to the same as $NAME when it asks for setup.

Extra steps for Windows

1. Convert the myCA.pem to myCA.pfx by doing:

   openssl pkcs12 -export -out myCA.pfx -inkey myCA.key -in myCA.pem
   

2. Import the myCA.pfx into the Trusted Certificate Authorities of Windows by opening (double-click) the myCA.pfx file, selecting "Local Machine" and Next, Next again, enter the password and then Next, and select "Place all certificates int he following store:" and click on Browse and choose "Trusted Root Certification Authorities" and Next, and then Finish.

Now your CA certificate is trusted by Windows. When you import and use the $NAME certificate it will be automatically trusted by Windows and Chrome.

Nutriment

I am wondering what the security implications for this might be? If anyone can become a certifying authority like this, how would the browser verify whether the website is legitimate or a fake one? Hackers can create valid certificates for any website they please.. – Malamud

@maverick browsers and operating systems ship with a limited number of CA's that they trust. Although anyone can become a CA, to get anyone to trust their certificates, they'd need people to manually add them as a trusted CA (as we tell Chrome to do when we manually import a certificate). – Nutriment

Great! Two remarks for Mac users like me: On the last line, use -days 825 instead of -days 1825 due to superuser.com/questions/1492643/…, and it's worth noting that to import the root cert into Key Chain Access, you need not only to "File > Import file", but then also to find it in the list, right click it, expand "> Trust", and select "Always". – Fda

if you need a PEM file instead of a CRT file for your local dev server don't worry, just combine .crt and .csr files and save them as a .pem file, and you are good to go. – Analphabetic

AT LAST IT WORKS! BRAVO for this answer. Please don't forget to load myCA.pem to your Chrome or Firefox (Settings > Manage certificates > Authorities > Import) – Shebeen

ALMOST. If you are Catilina, there is just a tiny bit moe you need. Add " extendedKeyUsage=serverAuth,clientAuth" below "basicConstraints=CA:FALSE", and make sure you set the "CommonName" to the same as $NAME when it's asking for setup (I did it for both the RootCA and my server cert. Source: podtech.io/os/mac-osx/chrome-catalina-certificate-issue – Halicarnassus

I changed DNS.1 to IP.1 for my IP-based LAN server. It works. Thanks. – Tsushima

The instructions are a bit unclear where should this NAME=mydomain.com go?? Is it here Common Name (e.g. server FQDN or YOUR name) []: ? – Emikoemil

@OZZIE, I hope I can help. I'm not sure if I grasp the crux of your confusion. Yes, NAME refers to your FQDN, but if an interactive prompt asks you for server FQDN or YOUR name, you are free to enter the site's name or your own name. The purpose of NAME=mydomain.com is just to set a variable so that it can be used in multiple places later in the shell script above, where it does matter that you use your "FQDN" instead of "YOUR name". (So if you were to copy-paste the script above, you wouldn't need to make very many changes; you could change mydomain.com to your FQDN.) – Nutriment

In Chrome/ium on Windows when you try to import the certificate, pem is not listed in the available file extensions, but it can still import it (just select all files filter). – Vogele

THANK YOU! Everything else I've read about this problem fails to mention creating your own signing authority. Problem solved. – Belen

if openssl hangs on Windows, add "winpty " before command text (e.g. winpty openssl genrsa ...) – Trawick

Works for me in Raspberry Pi OS Buster and express 4.17 – Sola

This actually works. Thank you very much! The certificate needs to be added to the "trusted root certification authorities" in Chrome to work. – Outlawry

This works perfectly, thank you! I've created a couple scripts from your answer to make my life easier. Not sure if you want to link to it in your answer. Cheers! – Polis

@JellicleCat when you say "Use the .crt and .key files in your server", which key are you referring to? myCA.key or $NAME.key? – Chausses

@BlackPanther the $NAME.key and $NAME.crt files are the ones that go on the web server. (And the myCA.key gets imported into the browser.) d(^_^o) – Nutriment

I tried editing the .ext file many times but still the cert is invalid. turns out it needs more parameter -extensions v3_req. see https://mcmap.net/q/35939/-subject-alternative-name-not-present-in-certificate – Puissant

Dont change your browser setting - change your OS setting instead – Combined

I wrapped it up in a makefile and tested under Ubuntu: gist.github.com/mcharytoniuk/a3770d71bc05acfe8d2aa8664f38e17b – Phonotypy

The first two commands need winpty appended to them or the command hangs in windows. – Lilley

This is fantastic. On Windows at least, you need to add set RANDFILE=.rnd before running the genrsa commands. And some other syntax changes: all $NAMEs should be %NAME%s, comments are with :: instead of # and if you want to create %NAME%.ext from command line/batch you can do (echo first line && echo second line && echo etc)>%NAME%.ext. – Mesonephros

Ok NVM I solved it, apparently you need to include winpty before the openssl commands, otherwise the process will crash. – Rorke

I couldn't get this to work for me, not sure why - but this similar article did work for me medium.com/better-programming/… – Meridithmeriel

Someone buy this man a beer. Works on my Debian workstation, as of 23 Feb 2021. Be sure to import the .pem file into "Authorities", not into "Your certificates" – Descriptive

May anyone tell why -CAcreateserial argument is required to create a signed certificate? Doesn't it just create a file containing a serial which is possible to get via openssl x509 -in "c.crt" -noout -serial anyways? – Tableland

'NAME' is not recognized as an internal or external command, operable program or batch file. – Tussis

@Tussis what shell are you using? The line NAME=... above is POSIX shell syntax for an assignment of a value to a variable named NAME, and later references to $NAME are also specific to POSIX. If you are using Window cmd, these will need to be changed to set NAME=... and %NAME%. (See the comment above by user3187724.) – Nutriment

github.com/salarmehr/ssl making it quicker to use for multiple local sites. – Pard

I used this excellent script with wildcard domain and got NET::ERR_CERT_COMMON_NAME_INVALID in chrome (v 91). Minor modification fixed it. Put [SAN] section above subjectAltName = @alt_names. And add ** -extensions SAN** to cert creation command: openssl x509 -req -in $NAME.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out $NAME.crt -days 825 -sha256 -extensions SAN -extfile $NAME.ext – Lelandleler

Where do I have to create the .ext file on windows? (I'm using openssl in powershell) – Coronagraph

Worked perfectly to create a "valid" certificate on my iMac! Now I can connect to Visual Studio code server on my iMac from my Chromebook without any issue. Wonderful! – Sitnik

It's unclear how to import into Chrome. If I click manage certificates in Chrome settings it opens Mac's notoriously buggy Keychain Access application. I assume I am supposed to be on the "login" screen from the left panel and underneath "Certificates" on the top panel (as opposed to "My Certificates") since this is where the application opened and I wasn't instructed to navigate away from this. I import the cert and nothing happens on the app's UI, so I tried via command line and it said it's already imported. Then I go to Chrome to test and it still says NET::ERR_CERT_AUTHORITY_INVALID. – Eskew

MacOS users: Add the CA to the SYSTEM certs. KeyChain Access makes it easy to accidentally add certs to the login chain, which can be confusing as hell because browsers will 'work' if you register both the CA pem and the cert file under the login group. Work is relative; child certs won't automatically be trusted. Just make sure you select the 'System' Keychain in the left panel. You can also just run sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain $CA_NAME.pem from terminal. – Amaurosis

If you want this to work on Android Chrome, set basicConstraints=CA:TRUE – Sauterne

I retrofitted some of this answer to work without bash and with all steps start to finish for installation of certs and everything https://mcmap.net/q/35904/-getting-chrome-to-accept-self-signed-localhost-certificate-closed – Manolo

Followed each step exactly as described; I can confirm this works in windows using Chrome version 113 – Idiotism

Works for me as well (Ubuntu 22.04.3 LTS, under WSL2). When you're generating the private key, you will be prompted for a PEM passphrase - this is mandatory. That wasn't obvious to me because so many of the other prompts are optional - to be on the safe side I just filled out absolutely everything (i.e. An optional company name). – Selfconsequence

Answer 2

For localhost only (Chrome 119 and above)

1. Simply visit this link in your Chrome:

   chrome://flags/#temporary-unexpire-flags-m118
   

2. You should see highlighted text saying:

   Temporarily unexpire flags that expired as of M118. These flags will be removed soon. – Mac, Windows, Linux, ChromeOS, Android, Fuchsia, Lacros

3. Click Enable Then relauch Chrome.

For localhost only (Chrome 118 and below)

1. Simply visit this link in your Chrome:

   chrome://flags/#allow-insecure-localhost
   

2. You should see highlighted text saying:

   Allow invalid certificates for resources loaded from localhost

3. Click Enable.

Options for other sites

• Try typing thisisunsafe anywhere on the window, and the browser should let you visit the page.

• For a local self-signed cert that avoids arcane commands, specialized knowledge, and manual steps, try mkcert from this answer.

Springtime

Disables the warning...but also the cache! bugs.chromium.org/p/chromium/issues/detail?id=103875 – Ovenware

this won't work if you're using chrome in Incognito mode (to switch identities for eg) but very clean otherwise – Amberambergris

This - if you can stand the annoying red Not Secure msg. Otherwise it's hours of mysterious openssl incantations then trying to deal with the internal cert manager in Chrome. – Rubenstein

I don't know why this answer has been voted but there is a difference between Invalid certificate and self-signed certificate. The question is about self signed cert. – Lunch

These steps don't work for self signed certificates; If you attempt to load a certificate at CA section of the cert import module on Chrome, it'll merely state that the certificate does not have a valid CA and won't do anything else, so it'll still complain about the certificate in the end. – Delight

This will disable any caching of the resources transferred over HTTPS regardless of what any cache headers might say, so be aware of that. – Radial

Did not work for me at all. What worked for me was to generate a self-signed certificate including subjectAltName, as explained by this answer: https://mcmap.net/q/35904/-getting-chrome-to-accept-self-signed-localhost-certificate-closed – Forestforestage

This does not work for self signed certificate and question was about it. Down vote from me. – Marven

This does not actually trust the certificate for localhost, it just suppresses some of the warnings about it being invalid. Anything that requires a secure origin, such as serviceworkers or source maps, continues to not work. – Bonkers

Doesn't work if I create an /etc/hosts entry with the original domain name pointing to 127.0.0.1, that's not considered as localhost by chrome. Spent 2 hours trying to make it work, still doesn't, troubleshooting in firefox now. – Barrelchested

Launching chrome with the command line flag --allow-insecure-localhost appears to work as well, if you want your launch dev to be more portable between computers – Vaginate

This was even in 2015 a bad answer – Rollmop

Seems this option has been changed to: chrome://flags/#block-insecure-private-network-requests – Ruling

In chrome 88, you can "unexpire" the flag by enabling: chrome://flags/#temporary-unexpire-flags-m87 – Phial

Makes a lot more sense than "becoming your own CA" - I mean, really? – Lockout

This also works for Edge (Chromium). Thanks for answer! – Huth

@mehdi I guess that localhost certificates are ALWAYS self-signed, because localhost is not "a" real site, but "everybody". – Choiseul

Does not work for a http request to localhost. Chrome translates this to a https request, and issues net::ERR_SSL_PROTOCOL_ERROR :-( – Choiseul

Not working, chrome has still issues with self signed certificates on localhost – Eri

This seemed to work for me but had to restart Chrome before it worked. – Hardtop

This flag is gone now: Chromw 119. support.google.com/chrome/thread/241869686/… – Ileanaileane

Since the flag "#allow-insecure-localhost" will be deprecated soon there is another one available called "#temporary-unexpire-flags-m118" at chrome://flags/#temporary-unexpire-flags-m118. It worked for me a few days ago! – Soyuz

chrome://flags/#allow-insecure-localhost worked for me in chrome 120 – Seldom

I've been beating my head against the wall trying to figure this out. Thank you!!! – Greece

Answer 3

This worked for me:

1. Using Chrome, hit a page on your server via HTTPS and continue past the red warning page (assuming you haven't done this already).
2. Open up Chrome Settings > Show advanced settings > HTTPS/SSL > Manage Certificates.
3. Click the Authorities tab and scroll down to find your certificate under the Organization Name that you gave to the certificate.
4. Select it, click Edit (NOTE: in recent versions of Chrome, the button is now "Advanced" instead of "Edit"), check all the boxes and click OK. You may have to restart Chrome.

You should get the nice green lock on your pages now.

EDIT: I tried this again on a new machine and the certificate did not appear on the Manage Certificates window just by continuing from the red untrusted certificate page. I had to do the following:

1. On the page with the untrusted certificate (https:// is crossed out in red), click the lock > Certificate Information. NOTE: on newer versions of chrome, you have to open Developer Tools > Security, and select View certificate.
2. Click the Details tab > Export. Choose PKCS #7, single certificate as the file format.
3. Then follow my original instructions to get to the Manage Certificates page. Click the Authorities tab > Import and choose the file to which you exported the certificate, and make sure to choose PKCS #7, single certificate as the file type.
4. If prompted certification store, choose Trusted Root Certificate Authorities
5. Check all boxes and click OK. Restart Chrome.

Djokjakarta

Alternate step 2: navigate to chrome://settings/certificates. Also if you've been messing with generating your self-signed cert and have made more than one, try using this page to locate and delete a previously imported cert, and then re-import. – Sew

chrome://settings/certificates no longer works, and there is no Authorities tab in Chrome settings > Security > Manage certificates. Has anyone got updated instructions? – Legume

chrome://settings/certificates does not exist fro Chrome under Windows. The certificates section merely opens the Windows cert-chain tool – Chrome does not seem to have an own storeage for certs un der Windows – Midweek

The EDIT steps of original answer worked for me using Chrome Version 99.0.4844.51. To save as PKCS #7, single certificate I used .p7b extension and imported as described here. – Eanes

Answer 4

Click anywhere on the page and type a BYPASS_SEQUENCE:

BYPASS_SEQUENCE	Chrome Version
thisisunsafe	65 - ?
badidea	62 - 64
danger	? - 61

You don't need to look for an input field; just type it. It feels strange but it works. I tried it on Mac High Sierra.

To double check if they changed it again, go to the latest Chromium source code. At the moment the BYPASS_SEQUENCE looks like this:

var BYPASS_SEQUENCE = window.atob('dGhpc2lzdW5zYWZl');

Now they have it camouflaged, but to see the real BYPASS_SEQUENCE you can run following line in a browser console.

console.log(window.atob('dGhpc2lzdW5zYWZl'));

OR

As an alternative to typing the phrase, you can paste this code snippet into the console.

sendCommand(SecurityInterstitialCommandId.CMD_PROCEED)

Praxis

I was so skeptical this would actually work, it felt like entering cheat codes into a game. But lo and behold, thisisunsafe really does work for Chrome 86. – Elysia

What should we do after typing that? Can you clarify more please? Because in Chrome 91 I see that the window.atob still gives us thisisunsafe. But when I type it nothing happens. – Czar

If you see the "this certificate is invalid" page simply type in the letters and the window should reload and display the content of the page. (I'm also on Chrome 91 and for me it still works.) – Jingo

As far as I can tell from the source code, this is equivalent to just clicking 'proceed'. – Singleton

The problem is that the button does not appear on localhost. – Jingo

instead of typing phrase you can paste the part of code in console sendCommand(SecurityInterstitialCommandId.CMD_PROCEED) – Wunderlich

This still works on Chrome version 100, April 2022. – Dorothadorothea

button appears for localhost for me too. – Shellans

Note: this only works for the browser. Any requests that come from code that accesses the same page will still get the SSL certificate error unless that check is disabled. – Cabstand

Answer 5

Update for Chrome 58+ (Released 2017-04-19)

As of Chrome 58, the ability to identify the host using only commonName was removed. Certificates must now use subjectAltName to identify their host(s). See further discussion here and bug tracker here. In the past, subjectAltName was used only for multi-host certs so some internal CA tools don't include them.

If your self-signed certs worked fine in the past but suddenly started generating errors in Chrome 58, this is why.

So whatever method you are using to generate your self-signed cert (or cert signed by a self-signed CA), ensure that the server's cert contains a subjectAltName with the proper DNS and/or IP entry/entries, even if it's just for a single host.

For openssl, this means your OpenSSL config (/etc/ssl/openssl.cnf on Ubuntu) should have something similar to the following for a single host:

[v3_ca]   # and/or [v3_req], if you are generating a CSR
subjectAltName = DNS:example.com

or for multiple hosts:

[v3_ca]   # and/or [v3_req], if you are generating a CSR
subjectAltName = DNS:example.com, DNS:host1.example.com, DNS:*.host2.example.com, IP:10.1.2.3

In Chrome's cert viewer (which has moved to "Security" tab under F12) you should see it listed under Extensions as Certificate Subject Alternative Name:

Rubadub

Hi, I added Subject Alternative name but, imported to My store and the CA authority is in the trusted store, rebooted Chrome but still it is saying SAN is missing – Aweigh

The v3_req option worked for me in getting the subjectAltName in the CSR. However, when generating the cert using my self-signed CA it was ignored. (Using LibreSSL 2.6.5) As shown in the OpenSSL cookbook (see "Creating Certificates Valid for Multiple Hostnames"), what I needed for the latter was create a myserver.ext text file containing subjectAltName = DNS:localhost . And then I ran openssl x509 -req ... -extfile myserver.ext . I could confirm SAN added via "openssl x509 -text -in myserver.crt -noout" – Pryer

Answer 6

On the Mac, you can use the Keychain Access utility to add the self-signed certificate to the System keychain, and Chrome will then accept it. I found the step-by-step instructions here:

Google Chrome, Mac OS X and Self-Signed SSL Certificates

Basically:

1. double-click the lock icon with an X and drag-and-drop the certificate icon to the desktop,
2. open this file (ending with a .cer extension); this opens the keychain application which allows you to approve the certificate.

Risky

After you open the cert in the keychain app, edit the trust settings and set SSL to "Always Trust" – Slavin

Answer 7

On the Mac, you can create a certificate that's fully trusted by Chrome and Safari at the system level by doing the following:

# create a root authority cert
./create_root_cert_and_key.sh

# create a wildcard cert for mysite.com
./create_certificate_for_domain.sh mysite.com

# or create a cert for www.mysite.com, no wildcards
./create_certificate_for_domain.sh www.mysite.com www.mysite.com

The above uses the following scripts, and a supporting file v3.ext, to avoid subject alternative name missing errors

If you want to create a new self signed cert that's fully trusted using your own root authority, you can do it using these scripts.

create_root_cert_and_key.sh

#!/usr/bin/env bash
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem

create_certificate_for_domain.sh

#!/usr/bin/env bash

if [ -z "$1" ]
then
  echo "Please supply a subdomain to create a certificate for";
  echo "e.g. www.mysite.com"
  exit;
fi

if [ ! -f rootCA.pem ]; then
  echo 'Please run "create_root_cert_and_key.sh" first, and try again!'
  exit;
fi
if [ ! -f v3.ext ]; then
  echo 'Please download the "v3.ext" file and try again!'
  exit;
fi

# Create a new private key if one doesnt exist, or use the xeisting one if it does
if [ -f device.key ]; then
  KEY_OPT="-key"
else
  KEY_OPT="-keyout"
fi

DOMAIN=$1
COMMON_NAME=${2:-*.$1}
SUBJECT="/C=CA/ST=None/L=NB/O=None/CN=$COMMON_NAME"
NUM_OF_DAYS=825
openssl req -new -newkey rsa:2048 -sha256 -nodes $KEY_OPT device.key -subj "$SUBJECT" -out device.csr
cat v3.ext | sed s/%%DOMAIN%%/"$COMMON_NAME"/g > /tmp/__v3.ext
openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days $NUM_OF_DAYS -sha256 -extfile /tmp/__v3.ext 

# move output files to final filenames
mv device.csr "$DOMAIN.csr"
cp device.crt "$DOMAIN.crt"

# remove temp file
rm -f device.crt;

echo 
echo "###########################################################################"
echo Done! 
echo "###########################################################################"
echo "To use these files on your server, simply copy both $DOMAIN.csr and"
echo "device.key to your webserver, and use like so (if Apache, for example)"
echo 
echo "    SSLCertificateFile    /path_to_your_files/$DOMAIN.crt"
echo "    SSLCertificateKeyFile /path_to_your_files/device.key"

v3.ext

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
    
[alt_names]
DNS.1 = %%DOMAIN%%

One more step - How to make the self signed certs fully trusted in Chrome/Safari

To allow the self signed certificates to be FULLY trusted in Chrome and Safari, you need to import a new certificate authority into your Mac. To do so follow these instructions, or the more detailed instructions on this general process on the mitmproxy website:

You can do this one of 2 ways, at the command line, using this command which will prompt you for your password:

$ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain rootCA.pem

or by using the Keychain Access app:

1. Open Keychain Access
2. Choose "System" in the "Keychains" list
3. Choose "Certificates" in the "Category" list
4. Choose "File | Import Items..."
5. Browse to the file created above, "rootCA.pem", select it, and click "Open"
6. Select your newly imported certificate in the "Certificates" list.
7. Click the "i" button, or right click on your certificate, and choose "Get Info"
8. Expand the "Trust" option
9. Change "When using this certificate" to "Always Trust"
10. Close the dialog, and you'll be prompted for your password.
11. Close and reopen any tabs that are using your target domain, and it'll be loaded securely!

and as a bonus, if you need java clients to trust the certificates, you can do so by importing your certs into the java keystore. Note this will remove the cert from the keystore if it already exists, as it needs to update it in case things change. It of course only does this for the certs being imported.

import_certs_in_current_folder_into_java_keystore.sh

KEYSTORE="$(/usr/libexec/java_home)/jre/lib/security/cacerts";

function running_as_root()
{
  if [ "$EUID" -ne 0 ]
    then echo "NO"
    exit
  fi

  echo "YES"
}

function import_certs_to_java_keystore
{
  for crt in *.crt; do 
    echo prepping $crt 
    keytool -delete -storepass changeit -alias alias__${crt} -keystore $KEYSTORE;
    keytool -import -file $crt -storepass changeit -noprompt --alias alias__${crt} -keystore $KEYSTORE
    echo 
  done
}

if [ "$(running_as_root)" == "YES" ]
then
  import_certs_to_java_keystore
else
  echo "This script needs to be run as root!"
fi

Aegyptus

Got "Error opening Private Key rootCA.key" when running $ ./create_root_cert_and_key.sh. macOS 10.12.4 and OpenSSL 0.9.8zh 14 Jan 2016. – Alitta

Running $ openssl genrsa -out rootCA.key 2048 before $ ./create_root_cert_and_key.sh fixes the "Error opening Private Key rootCA.key" error I ran into. – Alitta

@Alitta - thanks for pointing this out - i had that line duplicated so i'm sure it caused the issue you saw... – Aegyptus

openssl req -new -newkey rsa:2048 -sha256 -nodes -key device.key -subj "$SUBJECT" -out device.csris giving me the error "Error opening PRivate Key device.key" I thought this command was supposed to create device.key, but it seems to be trying to read it for some reason – Bunnell

Figured it out the solution (in case anyone else hits this) was to change -key to -keyout... openssl req -new -newkey rsa:2048 -sha256 -nodes -keyout device.key -subj "$SUBJECT" -out device.csr – Bunnell

How to use Win32OpenSSL do the same thing on windows 10 ? – Jockey

For FireFox users, you can Import the rootCA.pem file created in this script to the Authorities tab under the Certificates tab in FF preferences - quick link here - about:preferences#advanced. When creating the .pem file, the common name is what controls the URL that is viewed as secure. Example: Common Name (e.g. server FQDN or YOUR name) []:127.0.0.1 You can run the script again (rename the original so you don't override the first .pem file) and use localhost as a common name for a second time. Import both of these .pem files into FF and you will enjoy Green Locks – Zaria

I'm still getting an error in Chrome on my machine when doing this for localhost: Certificate error There are issues with the site's certificate chain (net::ERR_CERT_COMMON_NAME_INVALID). – Haddington

@gregblass - what domains are you trying to use this for, and what url are you loading in your browser? https://localhost/... or something like that? I just rebuilt my cert for https://localhost and it still seems to be working for me, for what it's worth.... – Aegyptus

The steps did not work for me. Starting all over again in a new folder, I followed these steps: ram.k0a1a.net/self-signed_https_cert_after_chrome_58, in addition to the OSX Keychain Access trick, and this greenlighted everything in Chrome. – Sideling

When I try to generate a cert without wildcards, I get an error, and the .crt file doesn't generate device.csr: No such file or directory – Triboluminescent

@Triboluminescent - did you run the create_certificate_for_domain.sh command first? I just tried it and it worked for me on a mac, both wildcard, and non wildcard approaches – Aegyptus

I think what's lacking here is the mention that you must make this cert work with your localhost webserver (apache, nginx, etc) – Semen

@Semen - that is typically where people would use them - but they could be used with proxies too - but that's just another kind of server for sure – Aegyptus

Can you update this with the instructions in serverfault.com/a/880809/114262 because of the new standards? – Atone

Actually changing the alternative DNS to the domain fixed it cat v3.ext | sed s/%%DOMAIN%%/"$DOMAIN"/g > /tmp/__v3.ext – Atone

So I create my keystore.jks and use the scripts above, eventually importing into the keystore, and browser is now giving me this: Error code: SSL_ERROR_NO_CYPHER_OVERLAP. I'm wondering, could I have missed an important step, or just goofed? – Quaternary

Did you do the "One more step - How to make the self signed certs fully trusted in Chrome/Safari" portion above as well? @badteeth – Aegyptus

@BradParks Nah, the client is going to be interacting with this via REST, and I was testing with httpie. But I also have a limited understanding here, and maybe I still need to do that step, heh. Will do it and update this comment. My task: update a JKS keystore that contains an expired cert, for localhost development. – Quaternary

yeah the "One more step - How to make the self signed certs fully trusted in Chrome/Safari" step basically really means "How to make this cert trusted everywhere in your system, except java" - So if you want it to work in Java too, follow that part as well! – Aegyptus

@BradParks Cool, I'm gonna keep grinding at this, hopefully helping the fellow in the end. But I was curious if I read this right 1) "how to make this trusted everywhere in your system except java", and 2) "do this if you want it to work in java", lol. Am I reading it right? – Quaternary

yeah one of them does it for everywhere except for special cases like the JVM, which requires an extra step, since it's kind of it's own little sandbox – Aegyptus

Answer 8

Linux

If you're using Linux, you can also follow this official wiki pages:

• Configuring SSL certificates on Linux.
• NSS Shared DB And LINUX
• NSS Shared DB Howto

Basically:

• click the lock icon with an X,
• choose Certificate Information
• go to Details tab
• Click on Export... (save as a file)

Now, the following command will add the certificate (where YOUR_FILE is your exported file):

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n YOUR_FILE -i YOUR_FILE

To list all your certificates, run the following command:

certutil -d sql:$HOME/.pki/nssdb -L

If it still doesn't work, you could be affected by this bug: Issue 55050: Ubuntu SSL error 8179

P.S. Please also make sure that you have libnss3-tools, before you can use above commands.

If you don't have, please install it by:

sudo apt-get install libnss3-tools # on Ubuntu
sudo yum install nss-tools # on Fedora, Red Hat, etc.

---

As a bonus, you can use the following handy scripts:

$ cat add_cert.sh
certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n $1 -i $1
$ cat list_cert.sh
certutil -d sql:$HOME/.pki/nssdb -L # add '-h all' to see all built-in certs
$ cat download_cert.sh
echo QUIT | openssl s_client -connect $1:443 | sed -ne '/BEGIN CERT/,/END CERT/p'

Usage:

add_cert.sh [FILE]
list_cert.sh
download_cert.sh [DOMAIN]

---

Troubleshooting

• Run Chrome with --auto-ssl-client-auth parameter

  google-chrome --auto-ssl-client-auth

Civilize

Excellent, I love your scripts. You don't need the QUIT though (there is no such HTTP command as QUIT anyway), and you don't need the sed either, the nss tools can filter out the cert between BEGIN and END CERT. So the download_cert.sh can be simply this: echo | openssl s_client -connect $1:443 – Southeastwards

I have tried the other options but only this one currently works in Chrome 4x for linux it refused to import to any store using built in tools. – Protrusion

With Chrome on Ubuntu 20.04 I couldn't get this to work passing the "P,," but was eventually able to get it to work using CT,c,c – Dragonroot

Answer 9

UPDATE 11/2017: This answer probably won't work for most newer versions of Chrome.

UPDATE 02/2016: Better Instructions for Mac Users Can be Found Here.

1. On the site you want to add, right-click the red lock icon in the address bar:

   2. Click the tab labeled Connection, then click Certificate Information

   3. Click the Details tab, the click the button Copy to File.... This will open the Certificate Export Wizard, click Next to get to the Export File Format screen.

   4. Choose DER encoded binary X.509 (.CER), click Next

   5. Click Browse... and save the file to your computer. Name it something descriptive. Click Next, then click Finish.

   6. Open Chrome settings, scroll to the bottom, and click Show advanced settings...

   7. Under HTTPS/SSL, click Manage certificates...

   8. Click the Trusted Root Certification Authorities tab, then click the Import... button. This opens the Certificate Import Wizard. Click Next to get to the File to Import screen.

   9. Click Browse... and select the certificate file you saved earlier, then click Next.

   10. Select Place all certificates in the following store. The selected store should be Trusted Root Certification Authorities. If it isn't, click Browse... and select it. Click Next and Finish

   11. Click Yes on the security warning.

   12. Restart Chrome.

Bremser

The Copy To File should be renamed to Save Certificate to make it clear what it is doing. – Pantograph

@AJeneral Yeah, Chrome changed again. The instructions in this article worked for me recently. – Bremser

I followed these steps on Version 36.0.1985.125 on windows and it worked for me – Geostrophic

This option doesn't exist on Mac Chrome latest as of the date of this comment. – Dee

@kgrote, Chrome does not have it's own certificate store. All it's doing is adding and removing the Windows one. As such, a better way is to simply use certmgr.msc to add and delete certs. – Klimt

Did work for me, thanks. Had to restart Chrome and most importantly my certificate had to expire before 2017. SHA-1 stuff. – Syllabub

I am trying to import fiddler tool's root certificate in chrome 55 on Windows 7 64 bit. This does NOT work. The cert does not appear in the Trusted store. – Cess

CHROME CHANGED YET AGAIN! Now the step "In the address bar, click the little lock with the X. This will bring up a small information screen." doesn't work. – Annabel

If it doesn't work make sure to check additionally answer UPDATE FOR CHROME 58+ (RELEASED 2017-04-19) – Radbourne

Requires Chrome restart for me (Windows 7, Chrome version 66) – Antiknock

Answer 10

UPDATED Apr 23/2020

Recommended by the Chromium Team

https://www.chromium.org/Home/chromium-security/deprecating-powerful-features-on-insecure-origins#TOC-Testing-Powerful-Features

Quick Super-Easy Solution

There is a secret bypass phrase that can be typed into the error page to have Chrome proceed despite the security error: thisisunsafe (in earlier versions of Chrome, type badidea, and even earlier, danger). DO NOT USE THIS UNLESS YOU UNDERSTAND EXACTLY WHY YOU NEED IT!

Source:

https://chromium.googlesource.com/chromium/src/+/d8fc089b62cd4f8d907acff6fb3f5ff58f168697%5E%21/

(NOTE that window.atob('dGhpc2lzdW5zYWZl') resolves to thisisunsafe)

The latest version of the source is @ https://chromium.googlesource.com/chromium/src/+/refs/heads/master/components/security_interstitials/core/browser/resources/interstitial_large.js and the window.atob function can be executed in a JS console.

For background about why the Chrome team changed the bypass phrase (the first time):

https://bugs.chromium.org/p/chromium/issues/detail?id=581189

If all else fails (Solution #1)

For quick one-offs if the "Proceed Anyway" option is not available, nor the bypass phrase is working, this hack works well:

1. Allow certificate errors from localhost by enabling this flag (note Chrome needs a restart after changing the flag value):

   chrome://flags/#allow-insecure-localhost

   (and vote-up answer https://mcmap.net/q/35904/-getting-chrome-to-accept-self-signed-localhost-certificate-closed by @Chris)

2. If the site you want to connect to is localhost, you're done. Otherwise, setup a TCP tunnel to listen on port 8090 locally and connect to broken-remote-site.com on port 443, ensure you have socat installed and run something like this in a terminal window:

   socat tcp-listen:8090,reuseaddr,fork tcp:broken-remote-site.com:443

3. Go to https://localhost:8090 in your browser.

If all else fails (Solution #2)

Similar to "If all else fails (Solution #1)", here we configure a proxy to our local service using ngrok. Because you can either access ngrok http tunnels via TLS (in which case it is terminated by ngrok with a valid certificate), or via a non-TLS endpoint, the browser will not complain about invalid certificates.

Download and install ngrok and then expose it via ngrok.io:

ngrok http https://localhost

ngrok will start up and provide you a host name which you can connect to, and all requests will be tunneled back to your local machine.

Gretel

Anyone trying to use localhost with https for service workers, the first point of If-all-fails worked for me on chrome 60 ubuntu 14.04 – Pampuch

this will still treat the cert as invalid and make the password manage refuse to work – Ichnography

Answer 11

If you're on a mac and not seeing the export tab or how to get the certificate this worked for me:

1. Click the lock before the https://
2. Go to the "Connection" tab

3. Click "Certificate Information"

   Now you should see this:

4. Drag that little certificate icon do your desktop (or anywhere).

5. Double click the .cer file that was downloaded, this should import it into your keychain and open Keychain Access to your list of certificates.

   In some cases, this is enough and you can now refresh the page.

   Otherwise:

6. Double click the newly added certificate.
7. Under the trust drop down change the "When using this certificate" option to "Always Trust"

Now reload the page in question and it should be problem solved! Hope this helps.

---

Edit from Wolph

To make this a little easier you can use the following script (source):

1. Save the following script as whitelist_ssl_certificate.ssh:

   #!/usr/bin/env bash -e
   
   SERVERNAME=$(echo "$1" | sed -E -e 's/https?:\/\///' -e 's/\/.*//')
   echo "$SERVERNAME"
   
   if [[ "$SERVERNAME" =~ .*\..* ]]; then
       echo "Adding certificate for $SERVERNAME"
       echo -n | openssl s_client -connect $SERVERNAME:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | tee /tmp/$SERVERNAME.cert
       sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" /tmp/$SERVERNAME.cert
   else
       echo "Usage: $0 www.site.name"
       echo "http:// and such will be stripped automatically"
   fi
   

2. Make the script executable (from the shell):

   chmod +x whitelist_ssl_certificate.ssh
   

3. Run the script for the domain you want (simply copy/pasting the full url works):

   ./whitelist_ssl_certificate.ssh https://your_website/whatever
   

Laux

This approach worked for me on OS X Mavericks, there was no Export option available as described in the top answer above. – Trample

Works great. The lock before https is still crossed out, but it's okay because there's no annoying popup anymore. – Derosier

Answer 12

For a test environment

You can use --ignore-certificate-errors as a command line parameter when launching chrome (Working on Version 28.0.1500.52 on Ubuntu).

This will cause it to ignore the errors and connect without warning. If you already have a version of chrome running, you will need to close this before relaunching from the command line or it will open a new window but ignore the parameters.

I configure Intellij to launch chrome this way when doing debugging, as the test servers never have valid certificates.

I wouldn't recommend normal browsing like this though, as certificate checks are an important security feature, but this may be helpful to some.

Phenomena

It worked for me in Windows 8! I just right clicked on chrome shortcut > Properties > Changed 'Target' field like this (note that '--ignore-certificate-errors' should be added after quote, and with space): "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --ignore-certificate-errors – Dacosta

This does not answer the question, and its dangerous. The question was how to get Chrome to trust a self signed server certificate; not how to ignore warnings and errors. – Sosna

This is the only solution that worked for me on Chrome (63.0.3239.108) with Windows 7 (64-bit). With regard to security I created special icon on desktop which I only launch when developing on a local virtual machine. Importing self-signed local certificates, tuning chrome://flags & HSTS domain did not help. Chrome should definitely keep that old good button "Add security exception" - it would save me 2 hours of struggling with useless settings. – Restharrow

This tutorial worked like a charm! youtube.com/watch?v=qoS4bLmstlk – Sandor

On Windows you can press Ctrl + R to get the Run dialog, then type chrome --ignore-certificate-errors – Playgoer

Answer 13

Filippo Valsorda wrote a cross-platform tool, mkcert, to do this for lots of trust stores. I presume he wrote it for the same reason that there are so many answers to this question: it is a pain to do the "right" thing for SubjectAltName certificates signed by a trusted root CA.

mkcert is included in the major package management systems for Windows, macOS, and several Linux flavors. It is also mentioned in the Chromium docs in Step 4 of Testing Powerful Features.

mkcert

mkcert is a simple tool for making locally-trusted development certificates. It requires no configuration.

$ mkcert -install

Created a new local CA at "/Users/filippo/Library/Application Support/mkcert" 💥
The local CA is now installed in the system trust store! ⚡️
The local CA is now installed in the Firefox trust store (requires browser restart)! 🦊

$ mkcert example.com "*.example.com" example.test localhost 127.0.0.1 ::1

Using the local CA at "/Users/filippo/Library/Application Support/mkcert" ✨

Created a new certificate valid for the following names 📜
 - "example.com"
 - "*.example.com"
 - "example.test"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./example.com+5.pem" and the key at "./example.com+5-key.pem" ✅

Aleris

I could not get this to work, at least for my subdomains of the sslip.io service. – Cladoceran

As of today on a brand new mac, I got this to work -- but oddly enough Chrome 100.0.48 was very finicky with the "Not Secure" message until I undid the allow-insecure-localhost flag and went into keychain and check "trust all" on the certificates.... I guess its "secure" now? Another workaround was dragging the certificate icons out of chrome on the desktop and reimporting them into keychain, re-trusting them. – Dee

Works like a charm if you don't forget to trust the CA with mkcert -install – Moxie

Answer 14

WINDOWS JUN/2017 Windows Server 2012

I followed @Brad Parks answer. On Windows you should import rootCA.pem in Trusted Root Certificates Authorities store.

I did the following steps:

openssl genrsa -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -newkey rsa:4096 -sha256 -days 1024 -out rootCA.pem
openssl req -new -newkey rsa:4096 -sha256 -nodes -keyout device.key -out device.csr
openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 2000 -sha256 -extfile v3.ext

Where v3.ext is:

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
IP.1 = 192.168.0.2
IP.2 = 127.0.0.1

Then, in my case I have a self hosted web app, so I need to bind certificate with IP address and port, certificate should be on MY store with private key information, so I exported to pfx format.

openssl pkcs12 -export -out device.pfx -inkey device.key -in device.crt

With mmc console (File/Add or Remove Snap-ins/Certificates/Add/Computert Account/LocalComputer/OK) I imported pfx file in Personal store.

Later I used this command to bind certificate (you could also use HttpConfig tool):

netsh http add sslcert ipport=0.0.0.0:12345 certhash=b02de34cfe609bf14efd5c2b9be72a6cb6d6fe54 appid={BAD76723-BF4D-497F-A8FE-F0E28D3052F4}

certhash=Certificate Thumprint

appid=GUID (your choice)

First I tried to import the certificate "device.crt" on Trusted Root Certificates Authorities in different ways but I'm still getting same error:

But I realized that I should import certificate of root authority not certificate for domain. So I used mmc console (File/Add or Remove Snap-ins/Certificates/Add/Computert Account/LocalComputer/OK) I imported rootCA.pem in Trusted Root Certificates Authorities store.

Restart Chrome and et voilà it works.

With localhost:

Or with IP address:

The only thing I could not achieve is that, it has obsolete cipher (red square on picture). Help is appreciated on this point.

With makecert it is not possible add SAN information. With New-SelfSignedCertificate (Powershell) you could add SAN information, it also works.

Reese

Important: Run OpenSSL as administrator. – Bookerbookie

But how to run Trusted Cert Store app? This answer is not complete – Schacker

Answer 15

As someone has noted, you need to restart ALL of Chrome, not just the browser windows. The fastest way to do this is to open a tab to...

chrome://restart

Cuffs

Hey! Just wanted to point out that this is what fixed it for me. I was adding a custom CA to the trust store, it had always worked for me that way. I tried Firefox and worked flawlessly but not chrome. At the end it was because it seems you need to fully restart chrome as you mention. It might be that Chrome keeps using the same trust store as long as those background processes are still running. – Sacking

Answer 16

1. Add the CA certificate in the trusted root CA Store.

2. Go to chrome and enable this flag!

chrome://flags/#allow-insecure-localhost

At last, simply use the *.me domain or any valid domains like *.com and *.net and maintain them in the host file. For my local devs, I use *.me or *.com with a host file maintained as follows:

3. Add to host. C:/windows/system32/drivers/etc/hosts

   127.0.0.1 nextwebapp.me

Note: If the browser is already opened when doing this, the error will keep on showing. So, please close the browser and start again. Better yet, go incognito or start a new session for immediate effect.

Wb

This seems to be the same as the top-voted answer. – Aleris

I've only added the domain names that are allowed in local development i.e. *.me sites to the host file in Windows. People add the certificate but sometimes the host just fails to verify the SSL verification even if the certificate is installed properly. In which case, we create a new session. I've only added those tips. I've gone through this rabbit hole too deep so I wanted to make sure someone knew what to do if it was needed. – Wb

Answer 17

Are you sure the address the site is being served up as is the same as the certificate? I had the same problems with Chrome and a self-signed cert, but in the end I found it was just incredibly picky about the validation of the domain name on the cert (as it should be).

Chrome doesn't have it's own cert store and uses Window's own. However Chrome provides no way to import certs into the store so you should add them via IE instead.

Installing Certificates in Google Chrome

Installing Certificates in Internet Explorer

Also take a look at this for a couple of different approaches to creating self-signed certs (I'm assuming you're using IIS as you haven't mentioned).

How to Create a Self Signed Certificate in IIS 7

Sousaphone

The site in question is localhost, and the CN of the certificate is "localhost". Yes, I did install the certificate in Windows's certificate store. Both IE and Chrome complain about the certificate. – Deas

Not sure if you're using IIS or Apache, but check the extra link I've just added on creating self-signed certs for IIS. – Sousaphone

Because of the incredibly picky about the validation of the domain name on the cert part: does someone knows more about that? I have a problem (it is 2019) on Android 9 with a root certificate, which is blamed as unsecure by Google Chrome. It is OK for FF and on desktop. – Azucenaazure

"Are you sure the address the site is being served up as is the same as the certificate?" - Good question, how can I tell? – Tova

Answer 18

I went down the process of using what bjnord suggested which was: Google Chrome, Mac OS X and Self-Signed SSL Certificates

What is shown in the blog did not work.

However, one of the comments to the blog was gold:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain site.crt

You'll need to follow the blog on how to get the cert file, after that you can use the command above and should be good to go.

Noahnoak

Answer 19

The GUI for managing SSL certs on Chromium on Linux did NOT work properly for me. However, their docs gave the right answer. The trick was to run the command below that imports the self-signed SSL cert. Just update the name of the <certificate-nickname> and certificate-filename.cer, then restart chromium/chrome.

From the Docs:

On Linux, Chromium uses the NSS Shared DB. If the built-in manager does not work for you then you can configure certificates with the NSS command line tools.

Get the tools

• Debian/Ubuntu: sudo apt-get install libnss3-tools

• Fedora: su -c "yum install nss-tools"

• Gentoo: su -c "echo 'dev-libs/nss utils' >> /etc/portage/package.use && emerge dev-libs/nss" (You need to launch all commands below with the nss prefix, e.g., nsscertutil.) Opensuse: sudo zypper install mozilla-nss-tools

To trust a self-signed server certificate, we should use

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <certificate-nickname> -i certificate-filename.cer

List all certificates

certutil -d sql:$HOME/.pki/nssdb -L

The TRUSTARGS are three strings of zero or more alphabetic characters, separated by commas. They define how the certificate should be trusted for SSL, email, and object signing, and are explained in the certutil docs or Meena's blog post on trust flags.

Add a personal certificate and private key for SSL client authentication Use the command:

pk12util -d sql:$HOME/.pki/nssdb -i PKCS12_file.p12

to import a personal certificate and private key stored in a PKCS #12 file. The TRUSTARGS of the personal certificate will be set to “u,u,u”.

Delete a certificate certutil -d sql:$HOME/.pki/nssdb -D -n <certificate nickname>

Excerpt From: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/linux_cert_management.md

Teeters

Answer 20

For Fedora, Ubuntu, Linux, if you're getting example.com Not a Certification authority error when adding the certificate using the GUI to add a new root authority. If you want to trust a server self signed certificate, it cannot make mention of an invalid authority... even if that's itself. I've only managed to make it work by trusting my authority and using that authorities key to sign server certificates.

Here's the self signed CA certificate that it accepted. This is the only way that I found works to get around cert_authority_invalid, I tried for hours to get it to accept a self signed end point certificate, no cigar. The UI will accept self signed authorities, as long as it's declared CA:TRUE. After that, all certs signed by that key with the correct DN will be accepted by Chrome without needing to add them independently.

openssl req -new -x509 -extensions v3_req -days 8440 -config ca.conf -key rockstor.key -out rockstor.cert

[req]
distinguished_name=dn
req_extensions=v3_req
prompt = no

[v3_req]
basicConstraints=CA:TRUE,pathlen:0
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName=@alt_names

[alt_names]
DNS.1 = ca.tdpowerskills.com

[dn]
C = US
ST = LA
L = Alexandria
O = TDPS Certification Authority
OU = LEARNOPS
CN = ca.tdpowerskills.com

openssl req -new -x509 -extensions v3_req -days 8440 -config config.conf -key rockstor.key -out rockstor.cert

[req]
distinguished_name=dn
req_extensions=v3_req
prompt = no

[v3_req]
basicConstraints=CA:FALSE
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName=@alt_names
issuerAltName=DNS:ca.tdpowerskills.com

[alt_names]
DNS.1 = big.tdps.app

[dn]
C = US
ST = LA
L = Alexandria
O = TDPS Certification Authority
OU = LEARNOPS
CN = ca.tdpowerskills.com

If that doesn't work:

• chrome://restart to actually restart

• Try to get more details on the error using Firefox, it tends to explain errors better. While Chrome will say: ERR_CERTIFICATE_INVALID, Firefox will throw: MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY.

• Remember that Chrome now requires Subject Alternate Name and nearly ignores CN.

For others:

• certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n <nickname> -i <my.crt> for server certificates

• certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n <nickname> -i <my.crt> for CAs

• For Firefox, the UI adding an exception certificate does work and it will trust it once you do that.

• Perhaps you have funky settings in /etc/pki/tls/openssl.cnf which get merged with your config.

• perhaps you're not adding an extension to the config or command line, such as v3_req

• Note, my method bypasses the need for a CSR by just signing the certificates with the authority key and adding details for the dev servers. CSRs allow more keys for actual security.

• I tried everything, but Chrome requires an authority with basicconstraints CA:true set. And server certificates must all be singed by a valid Authority, even if that's just another certificate that the signed themselves with CA:true.

Ichnography

Answer 21

Allowing insecure localhost work fine via this method chrome://flags/#allow-insecure-localhost

Just that you need to create your development hostname to xxx.localhost.

Virgina

Answer 22

To create a self signed certificate in Windows that Chrome v58 and later will trust, launch Powershell with elevated privileges and type:

New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "fruity.local" -DnsName "fruity.local", "*.fruity.local" -FriendlyName "FruityCert" -NotAfter (Get-Date).AddYears(10)
#notes: 
#    -subject "*.fruity.local" = Sets the string subject name to the wildcard *.fruity.local
#    -DnsName "fruity.local", "*.fruity.local"
#         ^ Sets the subject alternative name to fruity.local, *.fruity.local. (Required by Chrome v58 and later)
#    -NotAfter (Get-Date).AddYears(10) = make the certificate last 10 years. Note: only works from Windows Server 2016 / Windows 10 onwards!!

Once you do this, the certificate will be saved to the Local Computer certificates under the Personal\Certificates store.

You want to copy this certificate to the Trusted Root Certification Authorities\Certificates store.

One way to do this: click the Windows start button, and type certlm.msc. Then drag and drop the newly created certificate to the Trusted Root Certification Authorities\Certificates store per the below screenshot.

Rollick

@mpowrie. Having generated this, how do I link it the Apache webserver? On localhost server. – Bookstall

Ifedi Okonkwo: I'm not sure with Apache webserver sorry, but with IIS you add a site binding of type https, include the fully qualified hostname, and select the SSL certificate. – Rollick

This works like a charm. I'll say you'll need to do one additional step if you want to assign that cert as a binding...and that the cert needs to be in the Personal > Certificates as well. Dragging and dropping, for some reason, actually removed it from the Personal certs and placed it in the Trusted Certs. So make sure you copy and paste it. – Ravage

Answer 23

This worked for me. See: http://www.robpeck.com/2010/10/google-chrome-mac-os-x-and-self-signed-ssl-certificates/#.Vcy8_ZNVhBc

In the address bar, click the little lock with the X. This will bring up a small information screen. Click the button that says "Certificate Information."

Click and drag the image to your desktop. It looks like a little certificate.

Double-click it. This will bring up the Keychain Access utility. Enter your password to unlock it.

Be sure you add the certificate to the System keychain, not the login keychain. Click "Always Trust," even though this doesn't seem to do anything.

After it has been added, double-click it. You may have to authenticate again.

Expand the "Trust" section.

"When using this certificate," set to "Always Trust"

Pock

This seems to work! You may need to restart your browser at the end. – Cata

Answer 24

For Chrome on MacOS, if you have prepared a certificate:

• Quit Chrome (cmd+Q).
• Start the Keychain Access app and open the "Certificates" category.
• Drag your certificate file onto the Keychain Access window and type the password for the certificate file.
• Double click on your certificate and unfold the "Trust" list.
  • In row "When using this certificate," choose "Always Trust."
  • Close this stuff and type your password.
• Start Chrome and clear all caches.
• Check that everything is ok.

Cytosine

Answer 25

mkdir CA
openssl genrsa -aes256 -out CA/rootCA.key 4096
openssl req -x509 -new -nodes -key CA/rootCA.key -sha256 -days 1024 -out CA/rootCA.crt

openssl req -new -nodes -keyout example.com.key -out domain.csr -days 3650 -subj "/C=US/L=Some/O=Acme, Inc./CN=example.com"
openssl x509 -req -days 3650 -sha256 -in domain.csr -CA CA/rootCA.crt -CAkey CA/rootCA.key -CAcreateserial -out example.com.crt -extensions v3_ca -extfile <(
cat <<-EOF
[ v3_ca ]
subjectAltName = DNS:example.com
EOF
)

Vitavitaceous

This is the only one that worked for me with chrome 77. Thank you for saving my day. – Planetarium

How does one use the generated files? I understand how to use the domain .crt and .key files but what is the .csr file for? And how do I use the rootCA.* files? Please expand on your answer... – Copious

Answer 26

As of March 2020, on MacOS Catalina using Chrome 81, this has changed once you create a valid certificate using openssl as outlined above.

First, I browsed to my site using Safari and clicked on the link at the bottom of the the warning page that allows me to Access the Site Anyway. This added the certificate to my Mac Keychain (ie Keychain.app). Safari then would let me view the page. Chrome showed that the certificate was trusted, but wouldn't let me view the page. I continued to get the CERTIFICATE_INVALID error.

In Keychain, select All Items in the pane on the bottom left. Then search for your localhost DNS name (ie myhost.example.com).

Double click on your certificate. It’ll open an edit dialog for your cert.

Change "When using this Certificate" to "Always Trust"

This was totally counterintuitive because SSL was already set to Always Trust, presumably by Safari when the cert was added. Chrome only started working once I changed it globally to Always Trust. When I changed it back, it stopped working.

Tenpenny

Answer 27

June 2021 - Windows 10 - Chrome v91 (SIMPLE)

Follow the cert generation instructions from selfsignedcertificate.com:

Example domain name: mydomain.local, replace it with your domain name.

1. To generate a key:

   openssl genrsa -out mydomain.local.key 2048
   

2. Create the config file mydomain.local.conf with only the following content:

   [req]
   distinguished_name=req
   [SAN]
   subjectAltName=DNS:mydomain.local
   

   Note: In subcjectAltName you can define more domains (optional), like:

   subjectAltName=DNS:mydomain.local, DNS:*.mydomain.local, DNS:otherdomain.local, IP:192.168.1.10

3. Create the certificate:

   openssl req -new -x509 -key mydomain.local.key -out mydomain.local.crt -days 3650 -subj /CN=mydomain.local -extensions SAN -config mydomain.local.conf
   

4. Add the Cert to Trusted Root Certification Authorities

   • Right click the mydomain.local.crt file
   • Select Install Certificate from the context menu.
   • Choose Local Machine in the popup.
   • Choose Place all certificates in the following store.
   • Click Browse.
   • Choose Trusted Root Certification Authorities.
   • Click Ok, Next, Finish.
   • Restart Chrome.

Spithead

This looked promising (and serverfault.com/a/1017093/119666 was helpful), but it didn't work for me. In Brave (which is basically Chrome), I still get: NET::ERR_CERT_AUTHORITY_INVALID Subject: sslip.io Issuer: sslip.io – Cladoceran

Answer 28

When clicking the little crossed out lock icon next to the URL, you'll get a box looking like this:

After clicking the Certificate information link, you'll see the following dialog:

It tells you which certificate store is the correct one, it's the Trusted Root Certification Authorities store.

You can either use one of the methods outlined in the other answers to add the certificate to that store or use:

certutil -addstore -user "ROOT" cert.pem

• ROOT is the internal name of the certificate store mentioned earlier.
• cert.pem is the name of your self-signed certificate.

Uranalysis

certutil -addstore -user "ROOT" cert.pem is Windows? – Klimt

@Pacerier: Correct, it's for Windows. – Uranalysis

You mave have it in Trusted Root Certification Authorities but still issue remains: imgur.com/a/mjlglVz imgur.com/a/n8BFH5S Windows 10, chrome 78 – Marven

Answer 29

Fix for Chrome on Windows.

First, you need to export the certificate.

• Locate the url in the browser. “https” segment of the url will be crossed out with the red line and there will be a lock symbol to the left.
• Right click on the crossed-out "https" segment.
• You will see an information window with various information
• Click “details”.
• Export the certificate, follow directions accept default settings.

To import

• Go to Chrome Settings
• Click on "advanced settings"
• Under HTTPS/SSL click to "Manage Certificates"
• Go to "Trusted Root Certificate Authorities"
• Click to "Import"
• There will be a pop up window that will ask you if you want to install this certificate. Click "yes".

Ballplayer

It says it can't find the private key. – Dinodinoflagellate

You probably tried the import under the "Your certificates" tab, you need to use the one under the "Authorities" tab. – Babu

I tried importing under all tabs, none of those worked even after restarting chrome – Juieta

It does not work for me, imgur.com/a/xoqXaHD Win 10, chrome 78 here. – Marven

Answer 30

I was experiencing the same issue: I had installed the certificate in to Windows' Trusted Root Authorities store, and Chrome still refused the certificate, with the error ERR_CERT_COMMON_NAME_INVALID. Note that when the certificate is not properly installed in the store, the error is ERR_CERT_AUTHORITY_INVALID.

As hinted by the name of the error, this comment, and this question, the problem was lying in the declared domain name in the certificate. When prompted for the "Common Name" while generating the certificate, I had to enter the domain name I was using to access the site (localhost in my case). I restarted Chrome using chrome://restart and it was finally happy with this new certificate.

Ovenware

I am also using localhost but chrome is not happy about it imgur.com/a/mjlglVz Windows 10, Chrome 78. I followed instruction from here: https://mcmap.net/q/35904/-getting-chrome-to-accept-self-signed-localhost-certificate-closed I access the page via localhost – Marven

using common name "localhost" almost worked, and then finally it did work when I also launched chrome with option --allow-insecure-localhost – Tombaugh

Answer 31

As of Chrome 58+ I started getting certificate error on macOS due missing SAN. Here is how to get the green lock on address bar again.

1. Generate a new certificate with the following command:

   openssl req \
     -newkey rsa:2048 \
     -x509 \
     -nodes \
     -keyout server.key \
     -new \
     -out server.crt \
     -subj /CN=*.domain.dev \
     -reqexts SAN \
     -extensions SAN \
     -config <(cat /System/Library/OpenSSL/openssl.cnf \
         <(printf '[SAN]\nsubjectAltName=DNS:*.domain.dev')) \
     -sha256 \
     -days 720
   

2. Import the server.crt into your KeyChain, then double click in the certificate, expand the Trust, and select Always Trust

Refresh the page https://domain.dev in Google Chrome, so the green lock is back.

Maggy

This works for subdomains api.domain.dev but I still have a warning page on domain.dev: This server could not prove that it is domain.dev; its security certificate is from *.domain.dev. This may be caused by a misconfiguration or an attacker intercepting your connection. Any idea? – Recommit

Answer 32

This post is already flooded with responses, but I created a bash script based on some of the other answers to make it easier to generate a self-signed TLS certificate valid in Chrome (Tested in Chrome 65.x). Hope it's useful to others.

self-signed-tls bash script

After you install (and trust) the certificate, don't forget to restart Chrome (chrome://restart)

---

Another tool worth checking out is CloudFlare's cfssl toolkit:

cfssl

Strobotron

Answer 33

I fixed this problem for myself without changing the settings on any browsers with proper SSL certifications. I use a mac so it required a keychain update to my ssl certifications. I had to add subject alt names to the ssl certification for chrome to accept it. As of today, this is for Chrome version number: 62.0.3202.94

My example are easy to use commands and config files:

add these files and this example is all in one root directory

ssl.conf

[ req ]
default_bits       = 4096
distinguished_name = req_distinguished_name
req_extensions     = req_ext

[ req_distinguished_name ]
countryName                 = Country Name (2 letter code)
stateOrProvinceName         = State or Province Name (full name)
localityName                = Locality Name (eg, city)
organizationName            = Organization Name (eg, company)
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_max              = 64

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1   = localhost

Run command to create certification:

openssl req -newkey rsa:4096 -nodes -keyout key.pem -x509 -days 3650 -out certificate.pem -extensions req_ext -config ssl.conf -subj '/CN=localhost/O=Stackflow/C=US/L=Los Angeles/OU=StackflowTech'

For macs only to add trusted certification (required):

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./certificate.pem

For windows you will have to find how to verify our ssl certs locally independently. I don't use Windows. Sorry windows guys and gals.

I am using a node.js server with express.js with only requires my key and certification with something like this:

app.js

const https = require('https');
const Express = require('express');
const fs = require('fs');
const app = new Express();
const server = https.createServer({
    key: fs.readFileSync('./key.pem'),
    cert: fs.readFileSync('./certificate.pem'),
}, app);
server.listen(3000);

I may be doing this for other backend frames in the future, so I can update example this for others in the future. But this was my fix in Node.js for that issue. Clear browser cache and run your app on https://

Here's an example of running https://localhost on a Node.js server for Mac users:

https://github.com/laynefaler/Stack-Overflow-running-HTTPS-localhost

Happy Coding!

Concelebrate

Answer 34

It didn't work for me when I tried to import the certificate in the browser... In chrome open Developer Tools > Security, and select View certificate. Click the Details tab and export it.

// LINUX

sudo apt-get install libnss3-tools 

certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n [EXPORTED_FILE_PATH] -i [EXPORTED_FILE_PATH]

Run this command and if you see the file You've just imported You are good to go!

 certutil -d sql:$HOME/.pki/nssdb -L

// Windows

Start => run => certmgr.msc

On the left side select Trusted Root Certification Authorities => Personal. Click on actions tab => All actions/import then choose the file You exported before from the browser

Don't forget to restart chrome!!!

GOOD LUCK! ;)

Puentes

It works on desktop, but is it possible to have a solution for mobile chrome? My mobile accesses the localhost via https://192.168.1.127 – Interceptor

Had high hopes for this one. No Personal under that folder; just Certificates. went there, did import. Seemed to work. Didn't help. – Ashleyashli

Answer 35

I tried everything and what made it work: When importing, select the right category, namely Trusted Root Certificate Authorities:

(sorry it's German, but just follow the image)

Calabrese

Answer 36

This is something that keeps coming up -- especially for Google Chrome on Mac OS X Yosemite!

Thankfully, one of our development team sent me this link today, and the method works reliably, whilst still allowing you to control for which sites you accept certificates.

https://www.reddit.com/r/sysadmin/comments/3ercx4/chrome_shortcut_past_the_your_connection_is_not/cthporl

jersully posts:

If you don't want to bother with internal certificates...

1. Type chrome://flags/ in the address bar.
2. Scroll to or search for Remember decisions to proceed through SSL errors for a specified length of time.
3. Select Remember for three months.

Lexeme

Option not available in 49.0.2623.112m Windows – Abwatt

Answer 37

SSL / HTTPS localhost fix on the mac / osx:

1. Click the red lock with the cross in your address bar when trying to open your https localhost environment. There'll open a window with some information about the certificate.

2. Click on "Details" information window

3. The chrome Developer tools opens on the tab 'Security'. Click on View Certificate. The certificate image

4. Add it to your 'System' keychain (not your 'login' keychain which is selected by default).

5. Open your keychain (again) and find the certificate. Click on it and make sure you "Trust" all.

6. Restart chrome and it should work.

Reminiscent

Stupid graphical interface may not accept the certificate in MacoOS 10.14.5, but you can import it with security import filename.pem -k ~/Library/Keychains/login.keychain . The graphical gives an error -25294 – Haircloth

Answer 38

here my solution for WINDOWS maybe will work for LINUX

Git has openssl

C:\Program Files\Git\usr\bin\openssl.exe.

navigate to C:\Program Files\Git\usr\bin\ but add to the PATH best

create a folder for the certificate
create a file req.cnf
change the values like my company
do not delete the
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
there Chrome complains

C = CA
CA is two letters country code CA=Canada, US...
ST = ON is Province ON = Ontario

req.cnf

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = CA
ST = ON
L = Toronto
O = MyCompany
OU = MyDivision
CN = localhost
[v3_req]
keyUsage = critical, digitalSignature, keyAgreement
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost 
DNS.2 = www.mydomainname.com
DNS.3 = mydomainname.com

create the certificate in CMD

 openssl req -x509 -nodes -days 365 -newkey rsa:2048  -keyout server.key -out server.crt -config req.cnf -sha256

 cat server.crt server.key > server.pem

overwrite the dev certificate

 yourproject\node_modules\webpack-dev-server\ssl   with the **server.pem**

in chrome settings -> Manage certificates

import the server.crt to Trusted Certification Authorizes restart chrome

in package.json

 "scripts": {
    "start": "set HTTPS=true&&react-scripts start",

Carnassial

Answer 39

I just enabled allow-insecure-localhost flag in my chrome and that's it.

Steps.

1. Type chrome://flags in your chrome tab.
2. Search for allow-insecure-localhost flag and enable it.
3. Relaunch the chrome browser.

Now you will not see the insecure warning for your https://localhost sites.

Pampa

Answer 40

What am I supposed to do to get Chrome to accept the certificate and stop complaining about it?

You should create a PKI with;

1. self-signed Root CA.
2. sub / intermediate certificate [signed by Root CA].
3. normal / end-entity certificate [signed either by Root CA or sub-CA]
   • commonName or subjectAltName (SAN) as "localhost".
   • also include https://localhost/ as the URI in SAN.
4. Import / Install that Root CA in your Windows OS as 'Trusted Root Certification Authorities'.
   • Because you mentioned IE: Google Chrome is using the same resources while looking for certificates chain.
5. Install that end-entity certificate as your web server certificate, and it stops complaining that error message.

Hope this helps.

Energize

there is a script for all that at github.com/egberts/tls-ca-manage – Leasehold

Answer 41

I had success following the answer by kellen with the vital update from Toby J, but had to make this revision:

When creating the self-signed certificate, it was necessary to place the new subjectAltName field under the v3_ca extensions, instead of v3_req. I copied /etc/ssl/openssl.conf to a temporary file and then added a line subjectAltName = DNS:*.example.com under [ v3_ca ]. Then passed that file to the cert creation command, something like

  openssl req -x509 -nodes -newkey rsa:2048 \
          -config /tmp/openssl-revised.cfg \
          -keyout example.com.key -out example.com.crt

and followed kellen's updated steps.

Brahmin

Answer 42

My solution and explanation:

I had self signed certificate, created with the IIS resource kit tool SelfSSL.exe. In the certificates lists on my local computer I saw that this self signed certificate had only one purpose: Server Authentication. So I created new self signed certificate with both purposes: Server Authentication and Client Authentication. And now Chrome does not complain any more.

This article shows a lot of ways to generate self signed certificates. Note that not all options allow you to specify certificate purpose. I used the PowerShell way:

$cert = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname company.co.nz

Note: As stated by this answer by kellen Chrome does allow you set the purposes for certificates, however IMO it cannot add new purpose for a certificate if the last was not created with such in mind.

Sustainer

You sir are a genius! – Affricate

Answer 43

None of the answers above helped me on Windows 10 when testing locally on

https://localhost:<port>.

However I found this page, indicating another flag to pass:

https://www.chromium.org/blink/serviceworker/service-worker-faq

If you want to test on https://localhost with a self-signed certificate, do:

$ ./chrome --allow-insecure-localhost https://localhost

That did not get rid of the red warning, but it did enable me to use https-only feature like service workers and web push notifications.

Ossicle

This did not work for me in Chrome 65 on Windows 10. So I'm still struggling with https://mcmap.net/q/35942/-how-to-get-https-certificate-working-on-local-laravel-homestead-site/470749 – Cladoceran

Answer 44

Assuming you're on Mac OSX, you can also just open the URL in question in Safari; say; https://localhost:8080/css/app.css, allow the cert. Re-start Chrome, and it will work.

Cavity

Not sure why this was downvoted as it works perfectly fine – Wilterdink

I suspect it was downvoted because it only works on MacOS X and doesn't explain why it works. I suppose the keychain trust modification is the right answer for MacOS X, but you're right, it does work. – Emmott

Actually, it doesn't work for me. When Im opened the page in Safari for the first time, I had to tell Safari to open the site anyway and then I had to enter my admin password, to authorize the change to the keychain and ever since, I can open the site in Safari without a problem, but Chrome still keeps on warning me that it's unsafe. – Thruster

Answer 45

Windows: Single-File generate and self sign certificate

This is a "single-file" example to generate root and actual domain certificate on windows. Edit the first four variables, no further input from the CMD is required:

SET ROOT=my-root
SET NAME=demodomain
SET SUBJECT=/C=CH/O=My Demo Company
SET PASSWORD=ptGXHr3sudczSL9Q

:: Generate private key
openssl genrsa -des3 -out %ROOT%.key -passout pass:"%PASSWORD%" 2048
:: Generate root certificate 
openssl req -x509 -new -nodes -key %ROOT%.key -sha256 -days 3650 -out %ROOT%.crt -passin pass:"%PASSWORD%" -subj "%SUBJECT%"


openssl genrsa -out %NAME%.key 2048
openssl req -new -key %NAME%.key -subj "%SUBJECT%/CN=%NAME%" -out %NAME%.csr

(
echo authorityKeyIdentifier=keyid,issuer
echo basicConstraints=CA:FALSE
echo keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
echo subjectAltName = @alt_names
echo [alt_names]
echo DNS = %NAME%)>config.ext

openssl x509 -req -in %NAME%.csr -CA "%ROOT%.crt" -CAkey "%ROOT%.key" -CAcreateserial -out %NAME%.crt -days 1780 -sha256 -extfile config.ext -passin pass:"%PASSWORD%"

:: cleanup files used for certificate generation
del %NAME%.csr
del config.ext

If you want to have the complete chain in one file add the following to your bat file:

:: build chain in certificate-file
echo %ROOT%.crt >> %NAME%.crt
Type "%ROOT%.crt" >> %NAME%.crt

Append the following if you want to verify the certificate:

openssl verify -CAfile "%ROOT%.crt" -verify_hostname %NAME% %NAME%.crt

Open your root certificate my-root.crt and add it to the windows certificate store
(choose Trusted Root Certificate Authorities):

Final result in Chrome:

Wongawonga

I can confirm this works. I don't speak that scripting language, so I asked ChatGPT to translate that to bash and to generate it for my local domain, run the script and add the my-root.crt certificate to the Trusted Root Certificate Authorities and it works wonders! Thank you, sir! 💯 – Coupler

Answer 46

I had to tweak the Chrome launcher on macosx and added below script. Saved it as below;

/Applications/Google\ Chrome.app/Contents/MacOS/Chrome.command

#!/bin/sh
RealBin="Google Chrome"
AppDir="$(dirname "$0")"
exec "$AppDir/$RealBin" --ignore-certificate-errors "$@"

When I start Chrome with this script self-signed certificates are working without a problem. But don't browse the web with the browser launched with this script you will not be warned about invalid certificates!

Especial

This does not answer the question, and its dangerous. The question was how to get Chrome to trust a self signed server certificate; not how to ignore warnings and errors. – Sosna

it is still show me connection warnings, BTW, if it works on other mac versions it does answer the question. – Corvette

Answer 47

Here is a solution using only Java 8 keytool.exe instead of openssl:

@echo off
set PWD=changeit
set DNSNAME=%COMPUTERNAME%

echo create ca key
keytool -genkeypair -alias ca -keystore test.jks -keyalg RSA -validity 3650 -ext bc:critical=ca:true -dname "CN=CA" -storepass:env PWD -keypass:env PWD
echo generate cert request for ca signing
keytool -certreq -keystore test.jks -storepass:env PWD -alias ca -file ca.csr -ext bc:critical=ca:true
echo generate signed cert
keytool -gencert -keystore test.jks -storepass:env PWD -alias ca -infile ca.csr -outfile ca.cer -validity 3650 -ext bc:critical=ca:true
echo CA created. Import ca.cer in windows and firefox' certificate store as "Trusted CA".
pause

echo create server cert key for %DNSNAME%
keytool -genkeypair -alias leaf -keystore test.jks -keyalg RSA -validity 3650 -ext bc=ca:false -ext san=dns:%DNSNAME%,dns:localhost,ip:127.0.0.1 -dname "CN=Leaf" -storepass:env PWD -keypass:env PWD
echo generate cert request
keytool -certreq -keystore test.jks -storepass:env PWD -alias leaf -file leaf.csr -ext bc=ca:false -ext san=dns:%DNSNAME%,dns:localhost,ip:127.0.0.1
echo generate signed cert
keytool -gencert -keystore test.jks -storepass:env PWD -alias ca -infile leaf.csr -outfile leaf.cer -validity 3650 -ext bc=ca:false -ext san=dns:%DNSNAME%,dns:localhost,ip:127.0.0.1

rem see content
rem keytool -printcert -file leaf.cer -storepass:env PWD 

echo install in orig keystore
keytool -importcert -keystore test.jks -storepass:env PWD -file leaf.cer -alias leaf

echo content of test.jks:
keytool -list -v -storepass:env PWD -keystore test.jks
pause

You could also use pipes instead of files, but with the files, you can check the intermediate results if something goes wrong. SSL tested with IE11, Edge, FF54, Chrome60 on windows and Chrome60 on Android.

Please change the default password before using the script.

Peckham

Answer 48

Here the Way i do:

For Ubuntu / other Linux (in my case "example.org" - please use your own host for the whole Example Code):

1. Edit hosts File ("/etc/hosts") and put in the following:

   127.0.0.1    example.org
   

2. Do the following command in the Console:

   sudo apt-get install wget libnss3-tools
   

3. Then Do:

   sudo apt-get install -y ca-certificates
   

4. After this - do the following (important for create certificate):

   wget https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-amd64
   

5. Then do this command:

   sudo mv mkcert-v1.4.3-linux-amd64 /usr/bin/mkcert
   

6. Then set this for the access rights:

   sudo chmod +x /usr/bin/mkcert
   

Now you set up the mkcert - now we can use it:

Do this Command in the Terminal

sudo mkcert -install example.org 127.0.0.1

Now the files:

example.org+1.pem

and

example.org+1-key.pem

are created - just copy them to the folder "/etc/ssl":

sudo cp example.org+1* /etc/ssl/
  

Now just install your webserver (apache for me):

sudo apt-get install apache2
  

Then set the ssl mod to the webserver:

sudo a2enmod ssl
  

Ok - now just use the following command (for the vhost config):

sudo nano /etc/apache2/sites-available/example.org.conf
 

Now put the following there:

# HTTP
 
<VirtualHost *:80>
 DocumentRoot /var/www/html
 ServerName example.org
 ServerAlias www.example.org
</VirtualHost>
 
# HTTPS
 
<VirtualHost *:443>
 DocumentRoot /var/www/html
 ServerName example.org
 ServerAlias www.example.org
 SSLEngine on
 SSLCertificateFile /etc/ssl/example.org+1.pem
 SSLCertificateKeyFile /etc/ssl/example.org+1-key.pem
</VirtualHost>

Save it and do the following command in the Terminal (for add the vhost config to the webserver) (apache for me):

sudo a2ensite example.org.conf

Now at last you have to reload the Webserver (here apache):

sudo systemctl reload apache2

Now you have it - try to open now your website with the "https://" prefix (here: https://example.org) - it should now be working without any security error.

Beret

Answer 49

I couldn't find any of these answers that did everything from start to finish, so here are the steps for windows (I'm using win 11) with IIS installed, using openSSL (I used chocolatey to install openssl, not covered here) and using only vanilla PowerShell script language (no bash), without changing any browser settings at all (like allow-insecure-localhost), and no need to bypass security errors (e.g. thisisunsafe, badidea, danger).

This process here is only for creating local testing SSL certificates for faked domains and their subdomains that you've inserted into the C:\Windows\System32\drivers\etc\hosts file. (e.g. 127.0.0.1 example.com). You will need a separate line entry in the hosts file for each and every subdomain as well (e.g. 127.0.0.1 sub.example.com) because there doesn't seem to be a *.example.com way to do this. Be sure to leave an empty line at the end of the hosts file or you will go on a murderous rampage.

Some of this content was borrowed and updated from https://github.com/BenMorel/dev-certificates.

The below powershell script creates the 10-year CA certificate and key. You only need to create and install these files once, but you'll have to do it again if you lose these files because you can't generate the SSL certificates without them.

openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -subj "/C=US/O=_Development CA/CN=Development certificates" -key ca.key -sha256 -days 3650 -out ca.crt

The resultant ca.crt file has to be imported using the "manage computer certificate" interface (search for this app in your windows start popup), entered into the "trusted root certification authorities/Certificates" leaf. Right-click on said Certificates leaf and choose All Tasks/import, then select the file.

The below powershell script is for generating individual domain SSL certificates. You first need to global replace example.com with the desired domain, then execute it in powershell.

# replace anywhere you see example.com text with your domain
openssl genrsa -out "example.com.key" 2048
openssl req -new -subj "/C=US/O=Local Development/CN=example.com" -key "example.com.key" -out "example.com.csr"
"authorityKeyIdentifier=keyid,issuer" | Out-File -encoding utf8 -FilePath "example.com.ext"
"basicConstraints=CA:FALSE" | Out-File -encoding utf8 -FilePath "example.com.ext" -Append
"keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment" | Out-File -encoding utf8 -FilePath "example.com.ext" -Append
"extendedKeyUsage = serverAuth, clientAuth" | Out-File -encoding utf8 -FilePath "example.com.ext" -Append
"subjectAltName = @alt_names" | Out-File -encoding utf8 -FilePath "example.com.ext" -Append
"[alt_names]" | Out-File -encoding utf8 -FilePath "example.com.ext" -Append
"DNS.1 = example.com" | Out-File -encoding utf8 -FilePath "example.com.ext" -Append
"DNS.2 = *.example.com" | Out-File -encoding utf8 -FilePath "example.com.ext" -Append
openssl x509 -req -in "example.com.csr" -extfile "example.com.ext" -CA ca.crt -CAkey ca.key -CAcreateserial -out "example.com.crt" -days 3650 -sha256
rm "example.com.csr"
rm "example.com.ext"
certutil -p password,password -mergepfx example.com.crt example.com.pfx

Next go into IIS manager, select the top node (server), and select Server Certificates. Import (top right), and select the pfx file that was created earlier (password is 'password' unless you changed it above), and 'personal' certificate store. Next, select your site, select bindings (right side), and add (or edit) an https type, set the host name to your domain (e.g. example.com), select Require Server Name Indication, and then choose the SSL certificate you just installed. Repeat, adding a second https binding, but this time with a host starting with *. (e.g. *.example.com, * is important to include subdomains). If it won't accept the *, then you'll need a separate entry for each subdomain. Should work with all browsers, at least all Chromium browsers. Test. Celebrate.

Manolo

Answer 50

For development purposes on Windows you can
add to Chrome shortcut flag --ignore-certificate-errors

It expected to ignore certificate errors and allow you to access invalid certificate websites.
Better detailed instructions in https://support.opendns.com/entries/66657664.

Wiley

This is very dangerous! – Saavedra

This means that you are going to ignore cert errors on each and every site. Bad idea... – Ramp

@Saavedra notice is mentioned "For development purposes" – Wiley

@IlkerCat notice is mentioned "For development purposes" – Wiley

I've been stuck for so long with this problem (https://mcmap.net/q/35942/-how-to-get-https-certificate-working-on-local-laravel-homestead-site/470749) that I was willing to take the risk, but it didn't work on Chrome 65 on Windows 10. – Cladoceran

@Ryan, you can workaround issue using localtunnel that will temporarily proxy your server (with SSL and *.localtunnel.me domain) while running localtunnel. – Wiley

@Wiley That sounded really interesting, but I kept getting 504 Gateway Time-out Error like these people: github.com/localtunnel/localtunnel/issues/106 But it led me to laravel.com/docs/5.6/homestead#sharing-your-environment, which uses Ngrok and seems to work! It's a very temporary hack and isn't what I was hoping for, but it's certainly better than Chrome blocking my certificates. Thanks. – Cladoceran

Does not work for me, my self signed certifacte still is not seen as trusted. Win 10, Chrome 78 here. – Marven

Answer 51

Okay, assume you have created a "Valid" self-signed cert. And it installs correctly on chrome ver 94. But when you go to the site, you do not get an ssl lock and get "not a valid certificate authority" error. In fact, it is a valid cert. But if you do not browse the site correctly, you will get this error. My DNS for my cert was DNS1: TFDM, DNS2: TFDM.local, DNS3: 172.31.42.251, DNS4: 192.168.20.50.

I was browsing 192.168.20.50 and it would not secure(lock). The problem was, the cert was for DNS1: TFDM. So I had to enter into my /etc/hosts file (centos7) 192.168.20.50 TFDM for resolution - then browse https://TFDM. Problem solved. You MUST browse to the site properly. I thought it would resolve on the server side, but it must resolve on the client side. This is easily overlooked and can be your problem if everything else is correct. Overriding security and the ssl features is asking for trouble, and I don't consider a proper solution. Self-signed certs work if applied correctly and follow the rules that Chrome keeps changing.

Spume

Answer 52

For mac with Angular Micro-frontend using NX

Step 1: create a self-signed root certificate

openssl req -x509 -nodes -new -sha256 -days 390 -newkey rsa:2048 -keyout "RootCA.key" -out "RootCA.pem" -subj "/C=de/CN=localhost.local"
openssl x509 -outform pem -in "RootCA.pem" -out "RootCA.crt"

Step 2: define domains and subdomains that should be included in the certificate

For this, just create a text file named vhosts_domains.ext and insert the following contents:

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = localhost
DNS.2 = *.mixable.blog.local
DNS.3 = mixable.blog.local

This example includes subdomains for a local development environment for the domain mixable.blog.local and all subdomains like www.mixable.blog.local or apps.mixable.blog.local.

Step 3: create the certificate

openssl req -new -nodes -newkey rsa:2048 -keyout localhost.key -out localhost.csr -subj "/C=de/ST=State/L=City/O=Organization/CN=localhost.local"
openssl x509 -req -sha256 -days 1024 -in localhost.csr -CA RootCA.pem -CAkey RootCA.key -CAcreateserial -extfile vhosts_domains.ext -out localhost.crt

Step 4: make the certificate available for Angular application

nx serve host --open --devRemotes=<app names> --ssl --ssl-key <folder_location>/localhost.key --ssl-cert <folder_location>/localhost.crt

Step 5: add the certificates to macOS keychain from import

On chrome if you still get invalid certificate, then download the certificate and add to keychain and make all trusted.

Bedraggle