Few days ago (after an update) FF simply refused to accept my self-signed certificate anymore
Hello, Few days ago I noticed that Firefox started complaining about self-signed certificate issues, although I added my CA certificate to authorities months ago. It worked without any problem, but now I'm unable to open any of my internal sites anymore.
I tried to open a random site in Chrome, but the same issue. So you immediately will say the is in the certificate, but wait. I have few VMs running on Virtualbox, so I decided to test in there. Guess what, no issues at all. I tried in Fedora 25 (the Firefox version is below 100), then tried Windows 100. Both worked. Then I decided to update FF to the latest version, guess what - it broke again =]]
So something has changed, but I really don't have a clue what causes the issue. I attach the screenshot of detailed CA view from Firefox.
Solução escolhida
It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.
Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.
Ler esta resposta no contexto 👍 1Todas as respostas (2)
Solução escolhida
It must be due to removed "subject common name" fallback support from certificate validation. This fallback mode was previously enabled only for manually installed certificates. The CA Browser Forum Baseline Requirements have required the presence of the "subjectAltName" extension since 2012, and use of the subject common name was deprecated in RFC 2818.
Firefox from 101.0 onward no longer use certificate CN (Common Name) for matching domain name to certificate and have migrated to only using SAN (Subject Alternate Name) so if you self sign for internal devices you’ll need to regenerate.
Modificado por TyDraniu a
Hm, I think I saw something like "Subject Alternate Name" when I opened an internal site in Chrome.
So, let's see do I get it right - I need to recreate the CA certificate but instead using CN, I have to use SAN, right? The rest is the same?
What this means, will I be able to use again wildcard certificates for my internal sites, or I have to issue personal certificate for every site with specified SAN?
Sorry for my newbie questions, but I'm not certificate guru ;-=)
Modificado por KpuCko a