Description
This article describes about the certificate errors in Google Chrome for the SSL certificates of FortiManager and FortiAnalyzer.
A certificate signing request is generated in FortiManager/FortiAnalyzer.
The certificate is signed by well known trusted Certification Authority (CA) and correctly imported back to FortiManager/FortiAnalyzer.
The new certificate is selected in FortiManager/FortiAnalyzer under System Settings - > Admin Settings - > HTTPS & Web Service Certificate.
Although this certificate is accepted without errors by other browsers, Google Chrome is still returning privacy warning:
The certificate is signed by well known trusted Certification Authority (CA) and correctly imported back to FortiManager/FortiAnalyzer.
The new certificate is selected in FortiManager/FortiAnalyzer under System Settings - > Admin Settings - > HTTPS & Web Service Certificate.
Although this certificate is accepted without errors by other browsers, Google Chrome is still returning privacy warning:
Solution:
For Chrome 58 and later, only the subjectAlternativeName extension, not commonName, is used to match the domain name and site certificate.
The certificate subject alternative name can be a domain name or IP address. If the certificate does not have the correct subjectAlternativeName extension, users get a NET::ERR_CERT_COMMON_NAME_INVALID error letting them know that the connection is not private.
When generating a Certificate Signing Request (CSR) in FortiManager/FortiAnalyzer, make sure to fill in the Subject Alternative Name (SAN) field using the correct syntax.
The string should normally start with 'DNS:' (i.e., DNS:fmg.example.com), otherwise the SAN attribute will not be included in the request.
If multiple entries are required in the SAN field, they should be separated by comma+space (i.e., DNS:fmg.example.com, IP:10.11.12.13)
For example:
Once the CSR is generated, the user may use the tools provided by the trusted CA, or various online apps provided by other CAs, to verify if all attributes are in order before sending the request for signing.
For example by using the Check CSR tool on the DigiCert web page at: https://www.digicert.com/ssltools/view-csr/
Or, use this CertLogik tool to see more details: https://certlogik.com/decoder/
Various local certificate managing apps can also be used to verify the CSR content, like OpenSSL or XCA https://www.hohnstaedt.de/xca/
