SANNAV certificate + SANs

[ToreUthus]

Hi.

Has anyone managed to find out how to create a certificate with av SAN?

The chrome browser always complains about that.

Do we actually need to edit the openssl.conf to get this working?

[NimaG]

Hello ToreUthus,

The procedure to generate certificates is available at:

https://techdocs.broadcom.com/us/en/fibre-channel-networking/sannav/management-portal/2-2-x/v23724104/v24282502.html

Please let us know if this helps.

Thanks

[ToreUthus]

Hi.

I dont have a problem creating the basic certficate.

But the procesure does not create a certificate with a Certficate Subject Alternative Name.

An Chrome browsers always  complain about not haveing a SAN.

So it should be enabled by default in a .conf file 

[NimaG]

Hello ToreUthus,

The message "NET::ERR_CERT_COMMON_NAME_INVALID" generally indicates that the certificate is not correctly installed. It is not specific to SANnav.

Try the following:
- Re-install the certificate and check
- Verify the certificate details
- Clear the browser cache and SSL state
- Try with Edge or Firefox as they are also supported browsers

Regards

[ToreUthus]

@NimaG Hi again.

If you look at the bootom error message it clearly states:

"....it's Security certificate does not specify Subject Alternative Names

Chrome requires SSL Certificates to list the site name(s) in the subject alternative name (SAN) to be trusted. Usage of common name only is not seen as secure enough, and will result in a certificate validation error in Chrome.

This has been like since Chrome version 58.: https://developer.chrome.com/blog/chrome-58-deprecations/
"The compatibility risk for removing commonName is low. RFC 2818 has deprecated this for nearly two decades, and the baseline requirements (which all publicly trusted certificate authorities must abide by) has required the presence of a subjectAltName since 2012."

Internet Explorer works fine, but all Chrome browsers complain.

That's why Brocade should, by default, have the ssl configure file prepard to make the certificate with a SAN by default.

If I could just create a certficate with a SAN with a private key (as I normaly do on a windows server) and import that would also be great.
But the only optioin on SANnav is to create a CSR, use that to create a certifikate and import i back in.

[NimaG]

Hello ToreUthus,

Yes, the option to specify Subject Alternative Name is available when generating the CSR:

https://techdocs.broadcom.com/us/en/fibre-channel-networking/sannav/management-portal-installation-and-migration/2-3-x/v25174220/changing-ssl-certificates.html

Example:
Country Name (2 letter code, eg, US):US
State or Province Name (full name, eg, California):California
Locality Name (eg, city name):San Jose
Organization Name (eg, company name):*******
Common Name (Fully qualified Domain Name, or IP address):**.**.**.**
Email Address:abc@xyz.com
Subject Alternative Name, DNS (Fully Qualified Domain Name, or IP address):*******.com
Subject Alternative Name, DNS (Fully Qualified Domain Name, or IP address):<enter>
Subject Alternative Name, IPAddress (IP v4 or v6 address): 10.1.1.3
Subject Alternative Name, IPAddress (IP v4 or v6 address): <enter>

Generating CSR, file name is: 10.1.1.3.csr

Thanks

[ToreUthus · Accepted solution]

Figured it out.

Just created certificate as normal and not created a .csr from the SANnav. 
Case closed

[Sunitha_Mod]

Hello @ToreUthus,

That's excellent! 

We are extremely glad to know you were able to figure it out and we appreciate you for keeping us posted.