Skip to content
This repository was archived by the owner on Jan 24, 2026. It is now read-only.

Conversation

@mrgb7
Copy link
Owner

@mrgb7 mrgb7 commented Jun 5, 2025

🔧 Problem Fixed

This PR fixes Chrome certificate validation issues when using self-signed CA certificates generated by the TLS plugin on macOS systems. Chrome was showing "not valid certificate" warnings even after trusting the CA certificate.

🚀 Changes Made

Certificate Generation Improvements

  • ✅ Added proper Subject Alternative Name (SAN) extension with DNS names and IP addresses
  • ✅ Included CommonName in certificate subject for better compatibility
  • ✅ Added MaxPathLen constraints for proper CA certificate structure
  • ✅ Included localhost and loopback IP addresses for local development

Enhanced User Experience

  • ✅ Enhanced macOS trust instructions with multiple installation methods
  • ✅ Added Chrome-specific trust configuration steps
  • ✅ Added certificate validation function for debugging certificate issues
  • ✅ Added comprehensive troubleshooting guide for Chrome certificate problems

🔍 Technical Details

The main issue was Chrome's strict requirements for CA certificates, especially around the Subject Alternative Name extension:

  • Chrome (since version 58) no longer respects CommonName and requires SAN extension
  • Added proper CA certificate constraints and key usage settings
  • Enhanced trust instructions to cover both system keychain and Chrome's certificate store

🧪 Testing

After applying these changes, users should:

  1. Regenerate the CA certificate with the updated code
  2. Follow the enhanced trust instructions for macOS
  3. Restart Chrome completely after trusting the certificate
  4. Clear Chrome's cache and SSL data
  5. Verify certificates work properly in Chrome

📚 References

  • Chrome certificate validation requirements
  • macOS keychain trust configuration
  • Certificate validation best practices

Fixes: Certificate validation errors in Chrome when using TLS plugin generated CA certificates.

mrgb7 added 2 commits June 5, 2025 06:26
…- Add proper SAN extension, CommonName, and CA constraints - Include localhost and IP addresses for local development - Enhance macOS trust instructions and add Chrome-specific steps - Add certificate validation and troubleshooting guide
@mrgb7 mrgb7 merged commit b685930 into main Jun 5, 2025
6 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants