Score:2

create a self-signed certificate for a subdomain, the main domain does not belong to me

cn flag

I have my internet box provider who offers me a free subdomain to connect to my network, ex: xxxxx.provider.com

I have generated a self-signed certificate for the subdomain foo.provider.com I tried to install it in windows but it does not validate my certificate NET::ERR_CERT_COMMON_NAME_INVALID

Is it possible to generate a self-signed certificate on a subdomain and the main domain name does not belong to us?

dave_thompson_085 avatar
jp flag
Are you using Chrome or MSEdge, and did you create the cert to contain SubjectAlternativeName (SAN) _in addition to_ Subject.CommonName? Chrome and new-MSEdge require that, and otherwise give the somewhat misleading error you show. If so dupe https://serverfault.com/questions/1100986/chrome-shows-err-cert-common-name-invalid-when-firefox-is-happy and cross https://security.stackexchange.com/questions/172440/generate-x509-err-cert-common-name-invalid .
Pascal de Sélys avatar
cn flag
Thanks it's exactly that I added -addext "subjectAltName = DNS:xxxx.provider.com" and it works perfectly :)
Score:2
cn flag

A self signed certificate won't be trusted by any browser. What is the purpose of the certificate? If need a certificate that will work in browsers, you can use Let's Encrypt.

Pascal de Sélys avatar
cn flag
Thank you for your answer but it doesn't give me a solution for a self signed certificate
cn flag
Why do you need self-signed certificates? And why a public authority signed certificate is not a solution for you?
Pascal de Sélys avatar
cn flag
It's a small server hosted at home which is only used for the family :) that's why I use the host provided by my provider's box
cn flag
I understand. I recommend certificates signed by a public CA. Self signed certificates are bad for security.
Score:2
cn flag

The comment to my post by dave_thompson_085 helped me solve this,

I added -addext "subjectAltName = DNS:xxxx.provider.com" and reimported the certificate into windows and it works fine now

Here is the command I used to generate my self-signed certificate

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -addext "subjectAltName = DNS:xxxx.provider.com" -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt

I then answered Common Name (e.g. server FQDN or YOUR name) []: xxxx.provider.com

I then imported the certificate into my certificate manager in windows and it worked

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.