Question

我正在使用自己的CA并为HTTPS服务器创建了证书。我已通过this set of instructions和this set of instructions安装了根CA证书。

openssl s_client在我连接到我的网站时验证SSL证书并将其路径提供给/etc/ssl/certs/

但是当我尝试连接时，Chromium抱怨ERR_SSL_SERVER_CERT_BAD_FORMAT。

我目前很遗憾如何查看具体导致Chromium阻止我网站的内容。当我进入Chromium的设置并查看已安装的根CA证书时，我的根CA就会出现。

我怀疑它可能是X509v3扩展中缺少的字段。 openssl x509 -text -in https-server.crt的输出：

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 1 (0x1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, ST = Pennsylvania, CN = expandingdev.l5.ca
        Validity
            Not Before: Dec  6 03:05:24 2017 GMT
            Not After : Dec  6 03:05:24 2019 GMT
        Subject: C = US, ST = Pennsylvania, CN = tseng.l5.ca
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b8:7a:00:cf:e9:55:8d:ec:48:cc:00:57:e3:b5:
                    30:c4:a3:95:75:c4:a7:12:c8:11:91:d6:51:c3:9f:
                    45:56:5b:f2:25:36:fb:32:e5:d3:76:44:90:ba:f9:
                    20:1b:65:09:0a:63:a2:d7:7a:14:7d:ba:a6:24:fa:
                    dc:82:51:3b:32:6c:f1:3a:fb:4d:e4:1c:65:74:95:
                    4e:a6:bf:cb:49:f8:95:31:3a:d4:7a:90:09:d5:7c:
                    8c:90:d3:5a:10:a0:23:aa:22:75:84:19:dc:a7:ba:
                    ec:c4:fa:94:fb:12:b3:d4:b1:bc:66:7e:e8:43:a0:
                    d2:f8:f2:6d:00:3c:ef:43:f6:8b:9d:6b:7b:43:84:
                    8a:fb:f6:97:c8:18:59:2d:b2:4b:3c:ff:03:f7:90:
                    2a:d6:32:44:3d:08:52:e9:1d:34:9a:67:6c:a4:62:
                    3a:d9:78:bf:10:b1:63:38:b1:8d:25:a4:11:c3:6a:
                    c6:19:c0:59:1b:ac:0b:41:60:48:f1:fc:6b:e7:9d:
                    c9:5b:b8:fb:cc:03:94:0c:b2:18:80:46:f2:df:c2:
                    c7:ce:49:85:00:9d:8a:73:95:af:5f:aa:5d:88:11:
                    46:9f:ff:6f:67:17:04:d1:d6:12:a3:f0:5a:56:34:
                    1f:ec:a7:d0:3f:a3:df:f4:22:04:db:4f:ec:0c:cf:
                    83:67
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:tseng.l5.ca, DNS:localhost
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Subject Key Identifier: 
                C9:D8:8B:23:17:C2:BA:3F:35:0A:69:7C:73:5B:B9:98:54:09:79:F7
    Signature Algorithm: sha256WithRSAEncryption
         00:b0:89:0a:f0:67:e3:3d:72:ec:5a:58:04:b2:a1:5d:d7:fb:
         69:1d:e7:30:2f:04:f1:48:3c:55:a8:e9:1f:a6:3f:c9:98:37:
         1b:72:94:52:04:47:51:a0:0e:5a:36:7e:16:c7:2f:d0:37:cb:
         0e:3d:3d:bc:8b:b0:31:46:91:92:d0:19:59:38:29:eb:c3:39:
         5f:93:aa:07:6a:3d:c2:37:b9:45:5d:33:06:91:7f:e5:c6:59:
         9d:69:3a:59:f5:73:c1:61:67:95:cc:33:5c:46:25:eb:27:fc:
         5c:f9:cd:ce:a7:08:05:03:cb:3c:5f:ad:1f:89:7f:be:38:fd:
         43:84:94:fe:0e:6e:47:52:aa:0b:bf:f0:d6:e3:34:c6:80:6c:
         7a:c7:33:25:a1:e0:b2:23:c5:85:b8:a4:e8:de:c2:2f:ca:3f:
         f5:5f:21:b3:f8:c0:f1:d9:9e:8f:c4:b5:a2:fa:33:8b:33:69:
         f6:bb:fb:7c:e1:06:e9:98:f5:2c:70:c7:ef:72:fd:2e:c4:c4:
         f4:6a:1d:5d:46:be:4c:ec:07:fd:79:20:56:51:b1:cf:87:76:
         bf:54:27:82:95:a2:2e:33:0d:6d:78:0f:7a:d3:bd:70:06:35:
         b8:ac:d2:d1:79:78:64:80:b1:77:75:5a:6e:b2:ae:1d:c2:72:
         7f:99:3f:63
-----BEGIN CERTIFICATE-----
MIIDQDCCAigCAQEwDQYJKoZIhvcNAQELBQAwQTELMAkGA1UEBhMCVVMxFTATBgNV
BAgMDFBlbm5zeWx2YW5pYTEbMBkGA1UEAwwSZXhwYW5kaW5nZGV2Lmw1LmNhMB4X
DTE3MTIwNjAzMDUyNFoXDTE5MTIwNjAzMDUyNFowOjELMAkGA1UEBhMCVVMxFTAT
BgNVBAgMDFBlbm5zeWx2YW5pYTEUMBIGA1UEAwwLdHNlbmcubDUuY2EwggEiMA0G
CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4egDP6VWN7EjMAFfjtTDEo5V1xKcS
yBGR1lHDn0VWW/IlNvsy5dN2RJC6+SAbZQkKY6LXehR9uqYk+tyCUTsybPE6+03k
HGV0lU6mv8tJ+JUxOtR6kAnVfIyQ01oQoCOqInWEGdynuuzE+pT7ErPUsbxmfuhD
oNL48m0APO9D9ouda3tDhIr79pfIGFktsks8/wP3kCrWMkQ9CFLpHTSaZ2ykYjrZ
eL8QsWM4sY0lpBHDasYZwFkbrAtBYEjx/GvnnclbuPvMA5QMshiARvLfwsfOSYUA
nYpzla9fql2IEUaf/29nFwTR1hKj8FpWNB/sp9A/o9/0IgTbT+wMz4NnAgMBAAGj
TzBNMCEGA1UdEQQaMBiCC3RzZW5nLmw1LmNhgglsb2NhbGhvc3QwCQYDVR0TBAIw
ADAdBgNVHQ4EFgQUydiLIxfCuj81Cml8c1u5mFQJefcwDQYJKoZIhvcNAQELBQAD
ggEBAACwiQrwZ+M9cuxaWASyoV3X+2kd5zAvBPFIPFWo6R+mP8mYNxtylFIER1Gg
Dlo2fhbHL9A3yw49PbyLsDFGkZLQGVk4KevDOV+TqgdqPcI3uUVdMwaRf+XGWZ1p
Oln1c8FhZ5XMM1xGJesn/Fz5zc6nCAUDyzxfrR+Jf744/UOElP4ObkdSqgu/8Nbj
NMaAbHrHMyWh4LIjxYW4pOjewi/KP/VfIbP4wPHZno/EtaL6M4szafa7+3zhBumY
9Sxwx+9y/S7ExPRqHV1GvkzsB/15IFZRsc+Hdr9UJ4KVoi4zDW14D3rTvXAGNbis
0tF5eGSAsXd1Wm6yrh3Ccn+ZP2M=
-----END CERTIFICATE-----

我正在运行基于Debian 9.3构建的Chromium Version 63.0.3239.84（Developer Build），在Debian 9.3（64位）上运行。通过谷歌浏览器浏览时，我的Android 6.0手机上也出现此错误。

为什么Chromium抱怨而不让我进入我的网站？

网站：https://tseng.l5.ca
CA证书：http://tseng.l5.ca/CA.crt

Answer 1

    Version: 1 (0x0)
    ...
    X509v3 extensions:
        X509v3 Subject Alternative Name:

我不知道你是如何创建这个证书的。但基本上你已经创建了一个带有X509v3扩展名的X509.1证书。但是，这些扩展仅对X509.3而不是X509.1证书有效。这就是为什么Chrome正确地抱怨证书无效。

Chromium 6.3中的ERR_SSL_SERVER_CERT_BAD_FORMAT

1 个答案: