50

I am trying to setup a development environment on my local PC. As the production website supports HTTPS (who does not these days?), I want to have this also on the localhost. I thought it would be easy, but no.

I have a XAMP installation, and setup all so I can access the website. However, whenever I go to any page on the site locally, I get the chrome warning:

NET::ERR_CERT_AUTHORITY_INVALID

I did follow the following thread to try and solve it:

Getting Chrome to accept self-signed localhost certificate

I also created the certificate with the correct Subject Alternative Name (SAN) section, based on this:

https://deliciousbrains.com/https-locally-without-browser-privacy-errors/

After that, I generated the CER or P7B file and imported that into Chrome. I restarted both Apache and Chrome.

I put the certificate in the Trusted Root Certificate Authorities. Somehow, Chrome decided however to place it in the Intermediate Root Certificate Authorities...

I am using Chrome 61, I had the same in 60.

So somehow I am unable to install a self signed certificate, and keep getting this warning which basically makes development on localhost impossible...

I understand that this self-signing is not exactly trustworthy, but there must be a way to develop offline? It does not make sense that we have to build websites online from now on?...

Any ideas?

0

9 Answers 9

40

We can simply allow invalid certificates for developing purposes in chrome.

This is only valid for Localhost

Paste this in your chrome address bar:

chrome://flags/#allow-insecure-localhost

Then enable the highlighted text: Allow invalid certificates for resources loaded from localhost

enter image description here

4
  • 4
    I guess this only works if the URL says https://localhost, because it does not work with a domain that points to localhost / 127.0.0.1 on the /etc/hosts file
    – Rafa
    Mar 1, 2021 at 17:39
  • Honestly, if you're testing something for a one-off scenario, this is the best solution. Thanks!
    – Sujay66
    Apr 2, 2021 at 20:22
  • 2
    No it will not solve problems for domains with DNS to 127.0.0.1
    – Jos
    Jan 29, 2022 at 12:10
  • This answers the question. ***Use this for MS Edge: edge://flags/#allow-insecure-localhost Mar 10 at 21:27
8

Here are my instructions using the KeyStore Explorer tool. The two things I was previously missing when I created the cert were:

  • Adding in Authority Key Identifier (or AKID), select the same CN=<certificate_name> you used when creating it.
  • Adding in the Basic Constraints option (do not select "is a CA")

Without those two things Chrome will issue warnings/errors even when you have installed the self-signed certificate into your MS-CAPI PKI Trust store (as a Trusted Root Authority).

Steps:

1. Instructions using KSE (KeyStore Explorer)
2. Create a JKS
3. Creating a self-signed certificate
4. Open KeyStore Explorer
5. File | New | JKS | OK
6. Create a Password for your JKS file
7. File | Save as... | enter your password 
8. Enter file name | OK
9. Tools | Generate Key Pair
10. Select Algorithm and Key Size (i.e. 2048) | OK
11. Select validity period (i.e. 5 years) 
12. Select Name (Book icon) | Enter in Name fields | OK: I.e. “CN=localhost…<or SERVER_NAME>”
13. Add Extensions (Very Important), this determines what type of certificate it will be and how it can be used.  This example will be for a standard server certificate with SSL.
14. Add in the Key Usage item
  14.1. Add in the Digital Signature and Key Encipherment options checkbox
15. Add in the EKU (Extended Key Usage) options
  15.1. Select both of these options: "TLS Web Client Authentication" and "TLS Web Server Authentication"
16. Add in the SANs (Subject Alternative Name)
  16.1. Add in all the needed DNS names and IP Addresses (if applicable) for which this server will be used. (repeat for all desired values) (e.g. 127.0.0.1 and localhost (or <SERVER_NAME>)
17. When it is done you will see all the fields with the OIDs (Object Identifiers) listed | OK | OK
18. Add in the AKID (Authority Key Identifier)
  18.1. Add Extensions "+"
  18.2. Add Extension Type | Authority Key Identifier
  18.3. Select the Authority Cert Issuer of the CN that you created above (.e.g "CN=localhost...") | OK
19. Add in a "Basic Constraints" (do NOT check "Subject is a CA")
20. When you are done you will see these listed: hit "OK"

/**
 * Note: the Basic Constraints and AKID (Authority Key Identifer) are needed 
 * for the Chrome Browser to validate the self-signed certificate as a 
 * trusted certificate. Otherwise you'll see warning or error messages even 
 * after you have add this certificate, explicitly, to your MS-CAPI Trusted 
 * Root certificates.
 **/

21. Enter in the Alias of the keypair name you want to use
22. Enter in the private keypair password

/**
 * Note: this password MUST be the same as the JKS file keystore password or 
 * Java may fail silently when trying to use this certificate.
 **/
 
23. You should see a message indicating success. | OK 
24. Then, save the File | Save
6
  • 1
    This may sound stupid but what file extension should the file be and what do I do with it after these instructions?
    – K-Dawg
    Aug 14, 2018 at 9:43
  • see step # 5 above (JKS file extension). Then, right click in KeyStore Explorer and select "export" the "public key". You can then save this as either a .p7 or .cer / .crt extension. Once you have that file you can then import your .cer file into your chrome and/or FireFox browser which should resolve the issue, I believe.
    – atom88
    Aug 15, 2018 at 13:25
  • 2
    If you are planning on using the certificate on a webserver you must export the private key as well. Right click -> Export -> Export Private Key, Choose OpenSSL, uncheck Encrypt, choose file location, Export.
    – Shawn
    Feb 4, 2019 at 19:23
  • 2
    This just worked. After the creation I downloaded the certificate and added it for chrome. Now no more warnings appear.
    – Dominik
    Mar 8, 2019 at 11:24
  • 2
    finally find a way to use it in firefox. need go to about:config and change the configuration security.enterprise_roots.enabled to true.
    – RAGINROSE
    Jul 22, 2019 at 12:01
7

I fixed my exactly same issue following this .

Issue seemed to be in the way the certificate was created.

The code below is from the above site.

#!/usr/bin/env bash
mkdir ~/ssl/
openssl genrsa -des3 -out ~/ssl/rootCA.key 2048
openssl req -x509 -new -nodes -key ~/ssl/rootCA.key -sha256 -days 1024 -out ~/ssl/rootCA.pem


#!/usr/bin/env bash
sudo openssl req -new -sha256 -nodes -out server.csr -newkey rsa:2048 -keyout server.key -config <( cat server.csr.cnf )

sudo openssl x509 -req -in server.csr -CA ~/ssl/rootCA.pem -CAkey ~/ssl/rootCA.key -CAcreateserial -out server.crt -days 500 -sha256 -extfile v3.ext

server.csr.cnf file

[req]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn

[dn]
C=US
ST=New York
L=Rochester
O=End Point
OU=Testing Domain
emailAddress=your-administrative-address@your-awesome-existing-domain.com
CN = localhost

v3.ext file

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost
3
  • 5
    can you add some more details? What did you import to chrome? i did the same steps but still facing the error Dec 30, 2017 at 23:05
  • The 2 things I was previously missing when I created the cert were: AKID (Authority Key Identifier) - select the same "CN=" you used when creating it. Adding in the "Basic Constraints" option (do not select "is a CA") Without those 2 things Chrome will issue warnings / errors even when you have installed the self-signed certificate into your MS-CAPI PKI Trust store (as a "Trusted Root Authority).
    – atom88
    Feb 8, 2018 at 15:16
  • It showing on last command CA certificate and CA private key do not match Jul 12, 2018 at 21:52
2

There is a great GUI java-based utility that I use for creating and manipulating all things PKI called KeyStore Explorer. So much easier than all of the command-line options:

http://keystore-explorer.org/

0

I found this by pure chance: if you have Fiddler installed and let it run in the background, the first time your app runs will open a popup with the certificate issue and if you click 'yes' it will allow your requests through. See this https://www.telerik.com/forums/fiddler-certificate-error-bypass-question.

0
  1. Open your chrome browser

  2. Put the below link in the browser address bar and press Enter.

    chrome://flags/#allow-insecure-localhost

  3. Select "Allow invalid certificates for resources loaded from localhost." Disabled to Enabled.

Hope your problem will fix. Thanks

2
  • 1
    This is very insecure... it will allow all spoof websites Mar 18, 2021 at 2:12
  • removing PKI validation for your browser is a BAD idea. I wouldn't recommend doing this for security reasons.
    – atom88
    Nov 28 at 23:53
0

We had faced this issue some time back, the issue was that the addresses of the frontend and the API server were different.

The fronend was hosted on e.g. https://wrong.host.badssl.com when loaded would give this error. E.g:

SSL error Chrome

So under advance, we proceed to the site. Now the frontend loaded fine but the API calls were failing with this error: net::ERR_CERT_AUTHORITY_INVALID on browser console:

SSL chrome issue

The reason was that the frontend and API servers were different both having invalid SSL certificate.

Any of the below 2 solutions will work:

  1. Use same address / domain / IP address for frontend and API server
  2. Open the API server in new tab and click on advance and proceed with SSL warning
-1

Just update your java(or install java depends on your system architecture(32or64 bit)).

After the installation restarts the chrome browser then it will work fine.

I have been facing the issue for a long time. I just discovered this and it worked for me.

-1

Try disabling all your browser extensions and check if the problem is resolved.enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.