/SelfSignedCertSquidProxy

How to generate a self-signed certificate that will work with SquidProxy and Chrome 58+

How To: Generate a Self Signed Certificate

This document describes how to generate a self signed SSL certificate which is compatible with Chrome 58+ where the net::ERR_CERT_COMMON_NAME_INVALID error is shown with certificates that are generated by following the OpenSSL CLI prompts.

In particular, these certificates will work with SquidProxy for creating an HTTPS enabled proxy that will securely proxy your communication to the internet, but will also work with web servers or other secure network communication where certificates are used and a SAN is required.

  1. Generate the certificate configuration file: create a new file called certConfig.txt with the contents below. We'll use this file to fill in the required specifications and feed this file into OpenSSL to generate the actual certificate. 
    [req] 
distinguished_name = req_distinguished_name 
x509_extensions = v3_req 
prompt = no 
[req_distinguished_name] 
C = US 
ST = TX 
L = Irving 
O = MyCompany 
OU = MyGroup 
CN = my.domain.com 
[v3_req] 
keyUsage = keyEncipherment, dataEncipherment 
extendedKeyUsage = serverAuth 
subjectAltName = @alt_names 
[alt_names] 
DNS.1 = my.domain.com
  2. Generate the PEM file 
    openssl req -x509 -nodes -days 1365 -newkey rsa:2048 -keyout ./cacert.pem -out ./cacert.pem -config ./certConfig.txt
  3. Generate the CER file to import into the Windows "Trusted Root Certification Authorites" store 
    openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer
  4. Import the self-signed CER file into the Windows Trusted Root CA Store:
    1. Double click the CER file on the client machine to open it
    2. Click Install Certificate...
    3. Select the Local Machine option and click Next
      (Accept the elevated priviledges request if prompted)
    4. Choose Place all certificates in the following store
    5. Click Browse choose Trusted Root Certification Authorites and click OK
    6. Click Next and then Finish

SquidProxy Configuration

  1. Configure SquidProxy to use the PEM certificate 
    https_port 3129 cert=/cygdrive/c/cacert.pem