Tag: Microsoft Edge

Starting with version 58, Google has decided to remove support for the Subject Distinguished Name of web server certificates in the Chrome browser and instead only accept certificates with Subject Alternative Name.

Since then, web server certificates without a Subject Alternative Name in the form of a dNSName have been rejected by Google Chrome and other Chromium -based browsers (i.e. also Microsoft Edge ). Other browser manufacturers quickly adopted this approach, so that this problem now affects all popular browsers.

Continue reading "How the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can repair incoming certificate requests to make them RFC compliant"

Assume the following scenario:

• A web page is accessed using Google Chrome.
• The connection setup fails with the following error message:

Diese Website kann keine sichere Verbindung bereitstellen
test.intra.adcslabor.de hat eine ungültige Antwort gesendet.
Versuchen Sie, die Windows-Netzwerkdiagnose auszuführen.
ERR_SSL_PROTOCOL_ERROR

Continue reading "Google Chrome reports error code "ERR_SSL_PROTOCOL_ERROR" when opening a web page"

When troubleshooting, it can be very helpful to view encrypted SSL connections in order to inspect the messages within. There is a relatively simple way to do this with Wireshark.

Continue reading "Inspect TLS traffic with Wireshark (decrypt HTTPS)"

Apple recently announced that the Safari browser will in future only accept certificates with a validity of 398 days, provided they were issued on or after September 1, 2020.

Mozilla and Google want to implement comparable behavior in their browsers. So the question is whether this change will have an impact on internal certification authorities - i.e. whether in future internal SSL certificates will also have to follow these rules, as was the case, for example, with Google's enforcement of RFC 2818 .

Continue reading "Chrome and Safari limit SSL certificates to one year validity"

With the Chromium project and products based on it such as Google Chrome and Microsoft Edge, Google has moved to enforcing RFC 2818 , which was adopted in 2000, and to no longer trusting certificates that no longer fulfill the RFC.

For us, the following sentence is highly significant:

If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead

— https://tools.ietf.org/html/rfc2818

Continue reading "Generating an RFC 2818 compliant certificate request for SSL certificates"