PKI certificate

Question

Hello, I have enterprise CA in place and I would like to use enterprise signed certificate. The problem is that in every browser except Chrome everything is working fine, in Chrome I get an error NET::ERR_CERT_COMMON_NAME_INVALID. I know this problem is related to the Chrome which requires SAN to be specified along with the CN in the certificate. However I have put both values in Portecle during certificate generation. Is there any possible way to get it working?

Regards

Piotr

Abby Maris · Answer

The error ERR_CERT_COMMON_NAME_INVALID, commonly known as the SSL Common Name Mismatch Error. This error arises from a misconfiguration of certificates on a server, and it can disrupt the secure connection between a user and a website. Beyond its technical origins, this error can also be triggered by various factors such as third-party extensions, security programs like antivirus and firewalls, and more. It’s essential to note that this error can stem from inadequately implemented SSL certificates. There are different ways for resolving the error some are as follows:-

1) Check Date and Time accuracy

2) Validate Correct Certificate Installation

3) Identify Problematic Extensions

4) Validate Site Address Protocol

5) Clear SSL Cache

6) Review Proxy Settings

Andy Heinzer · Answer

I'm not certain of exactly how to do this in the portecle app.  However I did find other users that have gotten past this problem using the keytool utility included in the Oracle Java JDK.

Examples:

* https://community.atlassian.com/t5/Jira-questions/JIRA-Chrome-58-SSL-Security-missing-subjectAltName/qaq-p/581668
* https://stackoverflow.com/questions/8744607/how-to-add-subject-alernative-name-to-ssl-certs
* https://stackoverflow.com/questions/30755220/how-to-create-csr-with-sans-using-keytool/43637750#43637750

These all indicate that you can use the -ext attribute when generating the CSR and specify your dns alternative name, such as:

keytool -certreq -file test.csr -keystore test.jks -alias testAlias -ext SAN=dns:test.example.com