New issue
Advanced search Search tips

Issue 715914 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 700595
Owner: ----
Closed: Apr 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

NET::ERR_CERT_COMMON_NAME_INVALID

Reported by rcorra...@nuubo.com, Apr 27 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Example URL:
https://resource.local

Steps to reproduce the problem:
1. Using domain PKI certificate for webserver (SHA256)
2. CN is correct
3. There is no SAN in certificate.

What is the expected behavior?
Accept CN as usual in most browsers if certificate is recognized.

What went wrong?
Chrome requires SSL certificates to use SAN (Subject Alternative Name) instead of the popular Common Name (CN)
.

Did this work before? N/A 

Chrome version: 58.0.3029.81  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: 

I don´t think it´s a security risk to use CN in domain PKI certificates, since this update we are experience a big trouble in our company, this kind of changes should be advertised before.
 
Components: -Internals>Network Internals>Network>Certificate
Mergedinto: 700595
Status: Duplicate (was: Unconfirmed)
The examples of the insecurity related to Common Name support can be found at https://nameconstraints.bettertls.com/

Supporting common-name can allow for unconstrained, unverified, arbitrary certificates to be accepted as trustworthy.

Sign in to add a comment