Invalid certificate regarding localhost

[juergenzimmermann]

browser-sync 2.8.2 provides a new certificate #750 because the old one was expired. However, when using this certificate with https, then I get an error as shown in the attached screenshot.
The translation in English:

• title: data security Violation
• Verbindung = Connection
• "Die Identität ..." = "The identity of this web site wasn't verified. The Server certificate doesn't confirm with the URL".
  

[lindleywhite]

I have this issue as well. I don't think that the SSL Certificate was signed to localhost.

[shakyShane]

@lindleywhite, @juergenzimmermann

I've just been testing this issue again and can no-longer reproduce it. Can either of you?

[juergenzimmermann]

@shakyShane I just downloaded and installed the fresh browser-sync 2.8.3. The issue still exists. The certificate looks as follows:

However, it should look like this example:

The difference is: in your certificate you have "Internet Widgits Pty Ltd", but it should be "localhost" for local development

[shakyShane]

@juergenzimmermann could you please now try browser-sync@2.9.1

[juergenzimmermann]

You are almost there. Now Chrome only complains about the SHA-1 key to be an old algorithm (see below). I also attach a screenshot how Chrome looks when the cert is based on SHA-512.

Now the screenshot with a SHA-512 based cert:

[shakyShane]

Could you provide details about how you created that cert? Having trouble with that bit

[juergenzimmermann]

I guess you are using OpenSSL (another Option would be "keytool" from a Java installation). So here are my 2 commands for OpenSSL with line continuation for Windows (^):

openssl genrsa -out mykeyfile.pem 8192
openssl req -new -x509 -sha512 -key mykeyfile.pem ^
  -out mycertfile.cer -days <NumberOfDays> ^
  -subj "/emailAddress=my.name@foo.org/CN=localhost/OU=My Organizational Unit/O=My Organization/L=MyCity/ST=MyState/C=de"

"C" means country code with 2 characters. Of course, you can omit the email address or the city (L = location) from the subj(ect) parameter.
I took the infos from the man pages of OpenSSL:

• https://www.openssl.org/docs/manmaster/apps/genrsa.html
• https://www.openssl.org/docs/manmaster/apps/req.html

[shakyShane]

Thanks!

[shakyShane]

PR? :p

[juergenzimmermann]

Can you give me a pointer where you're generating the cert?

[shakyShane]

https://github.com/BrowserSync/browser-sync/tree/master/lib/server/certs

[shakyShane]

If you could also update that gen.sh file with the exact command you use also (only used for later reference)

[shakyShane]

Ignore the .pfx