2

So, I've generated a rootCA, and signed a certificate for *.a.com, how can I trust the resulting certificate in Firefox/Chrome, without trusting the CA directly?

Note that adding an exception (once) is not enough in this case, since there are multiple domains.

Improve this question

2 Answers 2

Reset to default
1

There are two possible approaches:

  1. Explicitly add the certificate to the browser certificate manager. Since Chrome and Firefox use NSS as their SSL library, this could be done using the following command (for Chrome):

    certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n SomeCertificateName -i /path/to/certificate

  2. Issue a subCA certificate limited by the nameConstraint extension, so that the subCA can only issue certificates with a.com suffix. Now trust this subCA only. This article explains this approach.
Improve this answer
0

Because the certificate is not issued by a trusted CA you will get the error for every domain the wildcard certificate applies to. Firefox stores certificate exceptions with the domain as the key, not the certificate so it will ask you to make an exception for every domain (even with a wildcard certificate).

If you don't want to trust the CA directly you can ask the CA owner to create an intermediate CA certificate for you, which you can use to issue certificates. You can then add the intermediate CA in your browser. (or you could just create a new CA)

Improve this answer
1
  • Did this answer your question?
    – mtak
    Commented Jun 12, 2014 at 9:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .