add subjectAltName for valid certification in recent browser #4
Conversation
|
hello @j31d0 could you help me out? i am having some issues regarding https websites |
|
I will try to solve issue when you give description of it (but this requests was made long ago, so I can't guarantee to solve it) |
|
The Issue is that when I am accessing HTTPS websites, the browser downloads a random named .bin file, for e.g I was wondering where I went wrong... Thank You for your help. |
|
I couldn't reproduce the result, but I got ERR_CERT_WEAK_SIGNATURE_ALGORITHM message in latest chrome, so I changed to use sha512 hash. (After that patch, proxy works well in my iMac) |
|
If you have more question or going to give more concrete issue, It may be better to make issue in my forked repository (https://github.com/j31d0/proxy2) |
|
Btw I changed the code to work on python3 as well |
| epoch = "%d" % (time.time() * 1000) | ||
| p1 = Popen(["openssl", "req", "-new", "-key", self.certkey, "-subj", "/CN=%s" % hostname], stdout=PIPE) | ||
| p2 = Popen(["openssl", "x509", "-req", "-days", "3650", "-CA", self.cacert, "-CAkey", self.cakey, "-set_serial", epoch, "-out", certpath], stdin=p1.stdout, stderr=PIPE) | ||
| p2 = Popen(["openssl", "x509", "-req", "-extfile", confpath, "-days", "3650", "-CA", self.cacert, "-CAkey", self.cakey, "-set_serial", epoch, "-sha512", "-out", certpath], stdin=p1.stdout, stderr=PIPE) | ||
| p2.communicate() |
| epoch = "%d" % (time.time() * 1000) | ||
| p1 = Popen(["openssl", "req", "-new", "-key", self.certkey, "-subj", "/CN=%s" % hostname], stdout=PIPE) | ||
| p2 = Popen(["openssl", "x509", "-req", "-days", "3650", "-CA", self.cacert, "-CAkey", self.cakey, "-set_serial", epoch, "-out", certpath], stdin=p1.stdout, stderr=PIPE) | ||
| p2 = Popen(["openssl", "x509", "-req", "-extfile", confpath, "-days", "3650", "-CA", self.cacert, "-CAkey", self.cakey, "-set_serial", epoch, "-sha512", "-out", certpath], stdin=p1.stdout, stderr=PIPE) |
from the recent browser, certificate with CN(Common Name) is not enough to verify. Chrome requires subjectAlternativeName for version 65 and later, so I added subjectAltName in certificate.