Chrome 58 Self Signed Certificate

1
votes

I'm now at the end of the road with no solution in sight. Just some background, I have a .net web application, and I also have a self hosted SignalR side application that customers can download to help my site interact with their desktop. When clients install this side application, it takes a self signed cert and installs to the Trusted Root Certification Authorities, and Personal certificate stores.

My site uses SSL with a valid certificate signed by Authority so it's running over https and clients see a nice green colored lock in the URL bar that makes everyone feel safe within the application. In order to get SignalR client working in JS, I must call using https (https://localhost:8080/signalr/.../). Now, to fix this I created a self signed certificate and bound to the port I was using for SignalR (8080). This worked fine for a long while but as of Chrome 58 self signed certificates require the SAN extension, which is fine. I created a new self signed certificate with the SAN extension but now a whole new error message: new error

If I just ignore this and proceed, it breaks my website SSL and customers see a red 'x' in the URL bar that doesn't make 'em feel to comfortable in the site. Also get, "Your connection is Not Private" warning. In reality, it's not my site that has the invalidity, it's the SSL cert bound to the port.

Are there any ways to fix this with a self signed certificate? Can I just bind the valid cert I have to clients ports and use that for SignalR?

I dont mind paying money for a valid cert, but the problem is, can I even request a cert for localhost?

1
c#google-chromesslsignalrself-signed
@LexLi and how Lets Encrypt will issue certificate for that domain if it resolves to 127.0.0.1? – Evk
@Evk just notice Let's Encrypt validate the IP address for validity. Then there would be no simple way to use "valid" certificates. Even if this guy would like to pay money, shipping a valid certificate everywhere is an attack to himself/herself. – Lex Li
@LexLi I appreciate the provided education, if you would have put that in an answer I would give you the credit....it requires I add a url reservation but not a big problem at all, thanks guy – code

1 Answers

1
votes

Like we discussed above under comments, it is not feasible for you to use a valid server certificate from CA, as distributing it everywhere (to your users) might be a critical security risk.

Thus, you will have to use a self-signed certificate, and adapt to all its limitations,

  • The certificate must be generated with SHA-2 hash now.
  • The certificate must have the proper SAN extension.
  • The certificate must be added to Trusted Root Authorities store.

As Chrome and other web browsers are changing rapidly, new limitations might be added soon.

You should probably provide your users a PowerShell script to automate the steps. That can minimize the impact on user experience.