Skip to main content

Return to Question

Notice removed Draw attention by CommunityBot
Bounty Ended with no winning answer by CommunityBot
edited tags
Link
sideshowbarker ♦
sideshowbarker ♦
  • 86k
  • 28
  • 209
  • 206
Notice added Draw attention by Robert Chapin
Bounty Started worth 50 reputation by Robert Chapin
added 135 characters in body
Source Link
Robert Chapin
Robert Chapin
  • 364
  • 2
  • 14

Chrome now throws NET::ERR_CERT_INVALID for some certificates that are supported by other browsers.

The only clue I can find is in this list of questions about the new Chrome Root Store that is also blocking enterprise CA installations.

https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md

In particular,

The Chrome Certificate Verifier will apply standard processing to include checking:

  • the certificate's key usage and extended key usage are consistent with TLS use-cases.
  • the certificate validity period is not in the past or future.
  • key sizes and algorithms are of known and acceptable quality.
  • whether mismatched or unknown signature algorithms are included.
  • that the certificate does not chain to or through a blocked CA.
  • conformance with RFC 5280.

I verified my certificates work as expected in Edge.

Further, I verified the certificate is version "3", has a 2048-bit key, and has the extended key usage for server authentication.

I still don't understand thewhich "standard" this certificate is expected to conform to when the browser only says "invalid". Is there a simple template or policy I can use?

Chrome now throws NET::ERR_CERT_INVALID for some certificates that are supported by other browsers.

The only clue I can find is in this list of questions about the new Chrome Root Store that is also blocking enterprise CA installations.

https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md

In particular,

The Chrome Certificate Verifier will apply standard processing to include checking:

  • the certificate's key usage and extended key usage are consistent with TLS use-cases.
  • the certificate validity period is not in the past or future.
  • key sizes and algorithms are of known and acceptable quality.
  • whether mismatched or unknown signature algorithms are included.
  • that the certificate does not chain to or through a blocked CA.
  • conformance with RFC 5280.

I verified my certificates work as expected in Edge.

I still don't understand the "standard" this certificate is expected to conform to when the browser only says "invalid". Is there a simple template or policy I can use?

Chrome now throws NET::ERR_CERT_INVALID for some certificates that are supported by other browsers.

The only clue I can find is in this list of questions about the new Chrome Root Store that is also blocking enterprise CA installations.

https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md

In particular,

The Chrome Certificate Verifier will apply standard processing to include checking:

  • the certificate's key usage and extended key usage are consistent with TLS use-cases.
  • the certificate validity period is not in the past or future.
  • key sizes and algorithms are of known and acceptable quality.
  • whether mismatched or unknown signature algorithms are included.
  • that the certificate does not chain to or through a blocked CA.
  • conformance with RFC 5280.

I verified my certificates work as expected in Edge.

Further, I verified the certificate is version "3", has a 2048-bit key, and has the extended key usage for server authentication.

I still don't understand which "standard" this certificate is expected to conform to when the browser only says "invalid". Is there a simple template or policy I can use?

Source Link
Robert Chapin
Robert Chapin
  • 364
  • 2
  • 14

What are the new requirements for certificates in Chrome?

Chrome now throws NET::ERR_CERT_INVALID for some certificates that are supported by other browsers.

The only clue I can find is in this list of questions about the new Chrome Root Store that is also blocking enterprise CA installations.

https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md

In particular,

The Chrome Certificate Verifier will apply standard processing to include checking:

  • the certificate's key usage and extended key usage are consistent with TLS use-cases.
  • the certificate validity period is not in the past or future.
  • key sizes and algorithms are of known and acceptable quality.
  • whether mismatched or unknown signature algorithms are included.
  • that the certificate does not chain to or through a blocked CA.
  • conformance with RFC 5280.

I verified my certificates work as expected in Edge.

I still don't understand the "standard" this certificate is expected to conform to when the browser only says "invalid". Is there a simple template or policy I can use?