How to mint a cert that Chrome will accept

Michael Green

Hey, I'm working on an RDS implementation and watched Ronnie's video and it was super helpful and got me up and running.

But Chrome doesn't like the cert. It sounds like it has to do with subject alternative names and I've tried making them in a different way but no matter what I do, Chrome does not seem to like y cert.

Any advice?

Ronnie Wong

@Michael-Green,

Try the following link:

https://support.google.com/chrome/a/answer/6342302?hl=en

I used IE or Edge which just used my certificate store but Chrome maybe different the link above should help get you started!

Michael Green

Yea..that looks like it's for Chrome OS. I just mean regular Chrome browser in Windows, so people can go to RDWeb in Chrome and not be greeted with error. Currently getting error NET::ERR_CERT_AUTHORITY_INVALID. In the extra information it talks about Subject Alternative names.

I figured it out. I made a wildcard cert, but had to make it by opening MMC, adding computer certificates snap in, then navigate to personal store, and right click on Personal and create a new cert. While going through the screens, there's an option for DNS name: and I guess that's the thing that the IIS server request leaves blank for whatever reason. Also, you have to make sure to go into one of the tabs and check "make exportable" so that you can get the .pfx file to import into the RDS roles.

After all this work though, it sounds like my company wants me to buy a wildcard cert so that an end user can use a non-work computer and still not see errors. Oh well, at least I learned something new. :)

Ronnie Wong

@Michael-Green,

I didn't even think about the Browser vs the OS....my fault but anyhow. Mediocre of me!

I never thought of using the wildcard certificate. Be careful with those and your CRL as you move forward...keep an eye on it if you're exposing this to the internet! :)