Issue metadata
Sign in to add a comment
|
NET::ERR_CERT_COMMON_NAME_INVALID
Reported by
rcorra...@nuubo.com,
Apr 27 2017
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Example URL: https://resource.local Steps to reproduce the problem: 1. Using domain PKI certificate for webserver (SHA256) 2. CN is correct 3. There is no SAN in certificate. What is the expected behavior? Accept CN as usual in most browsers if certificate is recognized. What went wrong? Chrome requires SSL certificates to use SAN (Subject Alternative Name) instead of the popular Common Name (CN) . Did this work before? N/A Chrome version: 58.0.3029.81 Channel: stable OS Version: 6.1 (Windows 7, Windows Server 2008 R2) Flash Version: I don´t think it´s a security risk to use CN in domain PKI certificates, since this update we are experience a big trouble in our company, this kind of changes should be advertised before.
,
Apr 27 2017
The examples of the insecurity related to Common Name support can be found at https://nameconstraints.bettertls.com/ Supporting common-name can allow for unconstrained, unverified, arbitrary certificates to be accepted as trustworthy. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by rdsmith@chromium.org
, Apr 27 2017