Webgui Https error NET::ERR_CERT_COMMON_NAME_INVALID

danb35 · Jul 15, 2017

danb35 said:
I'll assume (based on the bugs noted above), though I haven't yet tested, that 11-U1 does actually use the commonName as a SAN as well, but there's no field allowing you to specify additional SANs.

Now tested, and confirmed. Here's a cert I just generated on my FN11 box, for anyone else who wants to check:

Code:

It does have a SAN, but the SAN is just set to equal the CN and can't be changed through the FreeNAS web GUI. This would fix OP's problem, but wouldn't address any other possible uses of the SAN field.

zoomzoom · Jul 15, 2017

danb35 said:
Well, not everyone; I use the hostname.

It's been long enough since I used a consumer router that I don't know if it's a common capability, but my pfSense router, and my Linux server/router before that, both provid(ed) local DNS, and both make it easy to add a hostname -> IP mapping. Given that capability, why would you prefer to remember IPs for whatever you need to manage? Isn't that kind of the point of DNS?

To each their own, as one should utilize whichever way they're used to/is most efficient for them =]

You might be thinking at this point that this is getting a bit overly obsessive. You're probably right, but I'd counter that wanting to use SSL on a home LAN is probably a bit overly obsessive as well. And I'd suspect that pretty much anyone who has the ability to do anything even remotely intelligent with SSL, probably also has the capability to set up local DNS so they can use hostnames.

I don't think you're being overly obsessive, we just have different approaches to the same solution. For LANs, the issue comes down to basic security, as unless one is utilizing an SSL cert for WebUI logins, the password is passed via plaintext, which should never be allowed, regardless if one is the only one on a LAN or not. If one is okay with passing a WebUI's password over plaintext, then why has one created a password for that WebUI to begin with?

As a side note, and touching on a discussion we had some time back in another thread, your response here illustrates a drawback to your preferred MO of "continuously edit your post unless/until someone else has replied to the thread." I got an email notification of your reply, which at the time contained only one sentence. After I visited the thread to see that, I got no further notification of anything else (since there were no new posts).

As to editing posts, I've come across a few threads on this forum over the years of a user being reprimanded for trolling by moderators for adding new post after new post, instead of simply editing their original post if no one has replied yet. It seems not all moderators are on the same page on this... either way, from a simple efficiency standpoint, it's impractical and inefficient to post new post after new post, rather than simply editing the current post. Email alerts are an entirely separate issue and have no bearing on this, however, when replying to your posts in the future, if I have to make major edits, I'll delete and repost the edited post, which will issue an alert with the updated edits.

zoomzoom · Jul 15, 2017

danb35 said:
Now tested, and confirmed. Here's a cert I just generated on my FN11 box, for anyone else who wants to check:

It does have a SAN, but the SAN is just set to equal the CN and can't be changed through the FreeNAS web GUI. This would fix OP's problem, but wouldn't address any other possible uses of the SAN field.

While this can be fixed via editing the ssl creation script, there's three clear problems I see with that cert, and thereby all certs generated via the WebUI:

No KU specifying it's key usages, which for a Web/VPN server cert should be: keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
- This will result with Digital Signature, Non-Repudiation, Key Encipherment, Key Agreement (e8) under Key Usage in the cert
  - Technically, only nonRepudiation, keyEncipherment are required, however specifying nonRepudiation, digitalSignature, keyEncipherment, keyAgreement allows for all encryption protocol possibilities
No EKU, or OID 1.3.6.1.5.5.7.3.1, specifying it's Extend Key Usage as a server cert (opening up the opportunity for a MITM attack if utilizing it as a Web or VPN server cert), or specification as a client cert if utilizing it as a VPN client cert.
It lacks Basic Constraints ( basicConstraints = critical, CA:FALSE), of which all non-CAs/non-ICAs must always have.

danb35 · Jul 15, 2017

there's three clear problems I see with that cert

Sounds like a good bug report.

danb35 · Jul 15, 2017

zoomzoom said:
if I have to make major edits, I'll delete and repost the edited post, which will issue an alert with the updated edits.

...which it did. I'd disagree that "Email alerts are an entirely separate issue and have no bearing on this", as they're part of how the forum works, and what we do with posting should be informed by how the forum works.

I'm not dogmatic either way. I do what I do, and so far I haven't seen anyone complain about it. I'm certainly not asking you to take special care on my account; do what you want to do, and most likely it will be fine as well. But there are pros and cons to everything, and I thought what happened with that post was a good illustration of one of the cons. In any event, thread-jack over.

zoomzoom · Jul 15, 2017

It's worth a shot [filing a bug report], as the WebUI's config files would also need to be edited to create a box for passing additional arguments to the openssl script... however how passing those could be implemented in a sane manner would likely require a decent amount of time on reworking that script.

For example. here is my WebUI server cert [chained with ICA & CA to demonstrate chain of trust] showing what the above would like like in a cert:

Code:

danb35 · Jul 15, 2017

zoomzoom said:
It's worth a shot [filing a bug report], as the WebUI's config files would also need to be edited to create a box for passing additional arguments to the openssl script

Would that be necessary? I don't think FreeNAS is intended to serve as a general-purpose CA. Could it generate web-server certs, properly configured, without additional user input over what's already required?

zoomzoom · Jul 15, 2017

danb35 said:
Would that be necessary? I don't think FreeNAS is intended to serve as a general-purpose CA. Could it generate web-server certs, properly configured, without additional user input over what's already required?

Without user input, it would have to be configured to always issue server certs or always issue client certs (though a checkbox could simply be added to the WebUI to check if it's a client cert, thereby negating having to implement typed input).

Having it only issue server certs with the following set in the openssl.cnf should suffice:

Code:

[ CA_default ]
x509_extensions		 = usr_cert_not_dn

[ usr_cert_not_dn ]
basicConstraints		= critical, CA:FALSE
subjectKeyIdentifier	= hash
authorityKeyIdentifier  = keyid:always, issuer:always
keyUsage				= critical, nonRepudiation, digitalSignature, keyEncipherment, keyAgreement
extendedKeyUsage		= critical, serverAuth

This post provides a good explanation of which Key Usages allow what ciphers

danb35 · Jul 15, 2017

I'm thinking that the real intent of this system in the GUI is to create certs for the FreeNAS box itself, with some possible thought given to using it to create certs for other servers on the LAN. I don't think (though I could certainly be wrong in this regard) it was ever intended to create client certs.

zoomzoom · Jul 15, 2017

@danb35 Great point =]

q_fleuren · Aug 9, 2017

I've updated my system to FN 11

Where indeed the problem seems solved half the time.

It seems at random times the CA will still not include the SAN common name.
regenerating the same Ca with same settings will half of the time fix that :D

zoomzoom · Aug 9, 2017

@q_fleuren Please file a bug report and post the link back here.

Important Announcement for the TrueNAS Community.

Webgui Https error NET::ERR_CERT_COMMON_NAME_INVALID

danb35

Hall of Famer

zoomzoom

Guru

zoomzoom

Guru

danb35

Hall of Famer

danb35

Hall of Famer

zoomzoom

Guru

danb35

Hall of Famer

zoomzoom

Guru

danb35

Hall of Famer

zoomzoom

Guru

q_fleuren

Explorer

zoomzoom

Guru

Similar threads