How to trust a self-signed certificate without trusting a CA?


SeMeKh

So, I've generated the rootCA, and signed the certificate for *.a.com, how can I trust the generated certificate in Firefox/Chrome without directly trusting the CA?

Note that adding an exception (once) is not enough in this case because there are multiple domains.

SeMeKh

There are two possible ways:

  1. Add the certificate explicitly to the browser certificate manager. Since Chrome and Firefox use NSS as their SSL library, this can be done with the following command (for Chrome):

    certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n SomeCertificateName -i /path/to/certificate

  2. Issue subCA certificates restricted by nameConstraintextension so that subCA can only issue certificates with a.comsuffix . Only this subCA is now trusted. This article describes this method.

Related


How to trust a self-signed certificate without trusting a CA?

SeMeKh So, I've generated rootCA, and signed the certificate for *.a.com, how can I trust the generated certificate in Firefox/Chrome without directly trusting the CA? Note that adding an exception (once) is not enough in this case because there are multiple d

Client, how to trust self-signed certificate from IoT device?

Matija Martic I have an Expo app that works with IoT devices. To connect to the device, the user will continue to use the device's wifi and send it information about its wifi so that the device itself can connect to the wifi. So far, the network call from the

How to trust self-signed certificate in cURL command line?

00 I've created a self-signed certificate for foo.localhost using the Let's Encrypt suggestion using the following Makefile : include ../.env configuration = csr.cnf certificate = self-signed.crt key = self-signed.key .PHONY: all all: $(certificate) $(certi

How to trust Zypper's self-signed certificate?

Travis Thomas We are trying to build a repository for SuSE Linux based devices. We are authenticating the repository with a CA that contains a root self-signed certificate. When trying to retrieve an update from the repository, we get the following message: Co

Client, how to trust self-signed certificate from IoT device?

Matija Martic I have an Expo app that works with IoT devices. To connect to the device, the user will continue to use the device's wifi and send it information about its wifi so that the device itself can connect to the wifi. So far, the network call from the

Client, how to trust self-signed certificate from IoT device?

Matija Martic I have an Expo app that works with IoT devices. To connect to the device, the user will continue to use the device's wifi and send it information about its wifi so that the device itself can connect to the wifi. So far, the network call from the

How to trust self-signed certificate in cURL command line?

00 I've created a self-signed certificate for foo.localhost using the Let's Encrypt suggestion using the following Makefile : include ../.env configuration = csr.cnf certificate = self-signed.crt key = self-signed.key .PHONY: all all: $(certificate) $(certi

How to trust Zypper's self-signed certificate?

Travis Thomas We are trying to build a repository for SuSE Linux based devices. We are authenticating the repository with a CA that contains a root self-signed certificate. When trying to retrieve an update from the repository, we get the following message: Co

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Self-signed certificate with CA

Jawad-Dev: I am working on a solution for file encryption via a combination of RSA and AES. RSA is basically used here for a handshake to encrypt a symmetric key and decrypt with the key pair at the receiver side. I have used Java keystore for private key and

Android app SSL issue when trusting self signed certificate

Fragment 123 My app needs to connect to my own server, so I added the server's self-signed certificate to the KeyStore. It works fine on my server, but the problem is now my app won't accept all other certificates! For example, if I try to connect to https://m

Trust self-signed certificate from IIS

Thomas Schneider I have an externally hosted iis webserver that runs my website. I want to add a self-signed certificate to this website and trust it on my local client in order to remove the "insecure connection" from the browser. What I have done so far is t

npm trust self-signed certificate

n00dl3 I have a git repo on a personal server using a self-signed certificate. All I want to do is add this CA to npm's trusted certificates in order to install packages from the repo like this: npm install git+https://domain.tld/repo.git The following comman

Trust self-signed certificate from IIS

Thomas Schneider I have an externally hosted iis webserver that runs my website. I want to add a self-signed certificate to this website and trust it on my local client in order to remove the "insecure connection" from the browser. What I have done so far is t

Trust self-signed certificate from IIS

Thomas Schneider I have an externally hosted iis webserver that runs my website. I want to add a self-signed certificate to this website and trust it on my local client in order to remove the "insecure connection" from the browser. What I have done so far is t

npm trust self-signed certificate

n00dl3 I have a git repo on a personal server using a self-signed certificate. All I want to do is add this CA to npm's trusted certificates in order to install packages from the repo like this: npm install git+https://domain.tld/repo.git The following comman

Self-signed certificate - Trust anchor not found

Liquefied Potassium Edit: BNK in the comments has linked to the solution found here . I'm sending POST requests (over LAN) to a backend server via REST, all over HTTPS. The server has a self-signed certificate as a .pem file and everything works fine. I'm now

Trust self-signed certificate from IIS

Thomas Schneider I have an externally hosted iis webserver that runs my website. I want to add a self-signed certificate to this website and trust it on my local client in order to remove the "insecure connection" from the browser. What I have done so far is t

npm trust self-signed certificate

n00dl3 I have a git repo on a personal server using a self-signed certificate. All I want to do is add this CA to npm's trusted certificates in order to install packages from the repo like this: npm install git+https://domain.tld/repo.git The following comman

Trust self-signed certificate from IIS

Thomas Schneider I have an externally hosted iis webserver that runs my website. I want to add a self-signed certificate to this website and trust it on my local client in order to remove the "insecure connection" from the browser. What I have done so far is t