FreeNAS generated SSL certs rejected by Chrome 58

[spamminator]

Chrome 58 removes support for using the commonName to match a domain to certificate: https://www.chromestatus.com/features/4981025180483584

There is a ticket open for FreeNAS Corral (https://bugs.freenas.org/issues/22926) but I wanted to request that any Corral fixes for SAN support be backported to 9.10. I also wanted to point out that Chrome 58 is currently in Beta (which is how I ran across the issue) and will probably be promoted to stable within the next month.

 

[dlavigne]

Note that you'll also need to make this feature request for freenas9 in the bug tracker: https://bugs.freenas.org/projects/freenas/issues. Once made, you can add #22926 as a related bug. Please post the new bug number here.

 

[spamminator]

Created: https://bugs.freenas.org/issues/23130

Edit: not sure how to link bugs, but I linked to the Corral issue in the body of the bug.

 

[apirocet]

Hello, my first post -- I coincidentally started building my first FreeNAS server about the same time as Chrome 58 was released. I've been banging my head against the Chrome SSL problem for a few days now, and I finally came up with a workaround that should tide people over until the bug fix is released.

The following instructions assume that you're running (or want to run) the FreeNAS server with your own CA certificate and server certificate. The instructions should be run on the command line on a Unix system with openssl installed, except for the parts that require modification of the server through the FreeNAS web UI. Myself, I did all this on the FreeNAS host.

1. Create a work directory where you'll generate the SAN (subjectAlternateName) certificate, then change to it:
   
   
   Code:

   mkdir ~/sslwk
   export WKDIR=~/sslwk # if in the bash shell
   cd $WKDIR
   

   
   
2. Create an openssl.cnf file with the subjectAlternateName extension:
   
   
   Code:

   cat > subjAltName_openssl.cnf <<EOF
   [req]
   default_bits = 2048
   prompt = no
   default_md = sha256
   req_extensions = req_ext
   distinguished_name = dn
   
   [ dn ]
   # Edit these to match your data
   C=US
   ST=YourState
   L=YourTown
   O=FreeNASCSR
   emailAddress=youraddress@yourdomain.com
   # Primary IP of your FreeNAS server
   CN = 192.168.1.233
   
   [ req_ext ]
   subjectAltName = @alt_names
   
   [ alt_names ]
   # The first entry should be your primary Common Name (CN), 
   # the same as configured in your CA certificate
   IP.1 = 192.168.1.233
   DNS.1 = freenas.local
   DNS.2 = www.yourotherdomain.com
   EOF
   

   
   
3. Create a CA in the FreeNAS web UI (or use an existing CA)
   
   If you create a CA certificate, make sure to export it, then add it to your browser or system's Trusted Root Authority Certificate database.
   
   
4. Export the CA certificate and key in the FreeNAS web UI, then copy them to your work directory
   
   If you're working on the FreeNAS host, you can also directly copy them:
   
   
   Code:

   sudo cp /etc/certificates/CA/freenas_CA.crt /etc/certificates/CA/freenas_CA.key $WKDIR
   

   
   
5. Generate a certificate key:
   
   
   Code:

   openssl genrsa -out freenas_CRT.key 2048
   

   
   
6. Generate a CSR with the certificate key, and the subjAltNames included:
   
   
   Code:

   openssl req -new -sha256 -nodes -out freenas_CSR.csr -key freenas_CRT.key -config subjAltName_openssl.cnf
   

   
   
7. Verify the CSR:
   
   
   Code:

   openssl req -text -noout -in freenas_CSR.csr
   

   
   You should see lines like this, with your alternate names:
   
   Code:

   		 Requested Extensions:
   			X509v3 Subject Alternative Name: 
   				IP Address:192.168.1.233, DNS:freenas.local, DNS:www.yourotherdomain.com
   

   
   
8. Create the certificate, using the CSR as input, including the CA and the subjAltNames:
   
   
   Code:

   openssl x509 -req -in freenas_CSR.csr \
   									-CA freenas_CA.crt \
   									-CAkey freenas_CA.key \
   									-CAcreateserial \
   									-out freenas_CRT.crt \
   									-days 500 \
   									-sha256 \
   									-extfile subjAltName_openssl.cnf \
   									-extensions req_ext
   

   
   
9. Verify the certificate
   
   
   Code:

   openssl x509 -text -noout -in freenas_CRT.crt
   

   
   You should see a line like this, with your alternate names:
   
   Code:

   		X509v3 extensions:
   			X509v3 Subject Alternative Name: 
   				IP Address:192.168.1.233, DNS:freenas.local, DNS:www.yourotherdomain.com
   

   
   
10. Copy and paste the certificate and key into FreeNAS web UI (System/Certificates -> Import certificate):
    
    
    Code:

    cat freenas_CRT.crt
    cat freenas_CRT.key
    

    
    
11. Select this new certificate in the FreeNAS web UI System/General tab, and save the updated config.
    
    
12. Test with openssl at the command line:
    
    
    Code:

    openssl s_client -showcerts -connect 192.168.1.233:443 -CAfile freenas_CA.crt
    

    
    
    You should see lines like this:
    
    
    Code:

    		CONNECTED(00000004)
    		depth=1 C = US, ST = YourState, L = YourTown, O =  FreeNAS CA, CN = 192.168.1.233, emailAddress = youraddress@yourdomain.com
    		verify return:1
    		depth=0 C = US, ST = YourState, L = YourTown, O = FreeNASCSR, emailAddress = youraddress@yourdomain.com, CN = 192.168.1.233
    		verify return:1
    		[...]
    		Verify return code: 0 (ok)
    

    
    HTTPS should now work in Chrome 58+, and you should be able to access the secure site from any of your domain name aliases.
    
    
13. Once you have verified that everything is working as it should, remove your SSL work files:
    
    
    Code:

    rm -ri $WKDIR
    

    
    

 

[elforesto]

Semi-workaround in Chrome is to disable HSTS for any sites using certs issued from this CA. You'll still get a warning, but you now will have the option to bypass it and still get to your box without using Edge (ugh) or IE (hurk). Go to chrome://net-internals/#hsts and delete each domain you still need to get access to.