為了讓 Edge 信任 localhost 開發服務器，我按照本教程創建了一個自簽名證書。我剛剛用 localhost 替換了 client-1.local 的所有實體。
所以簡而言之，我通過使用命令創建一個 .pem 檔案來創建一個受信任的權限
openssl genrsa -des3 -out rootSSL.key 2048
然后
openssl req -x509 -new -nodes -key rootSSL.key -sha256 -days 1024 -out rootSSL.pem
并將它們匯入到 MMC 中的受信任的權威存盤中。
然后我創建了一個私鑰
openssl req -new -sha256 -nodes -out localhost.csr -newkey rsa:2048 -keyout localhost.key -subj "/C=AU/ST=NSW/L=Sydney/O=Client One/OU=Dev/CN=localhost/[email protected]"
和證書
openssl x509 -req -in localhost.csr -CA rootSSL.pem -CAkey rootSSL.key -CAcreateserial -out localhost.crt -days 50000 -sha256 -extensions "authorityKeyIdentifier=keyid,issuer\n basicConstraints=CA:FALSE\n keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment\n subjectAltName=DNA:localhost"
證書在雙擊時顯示為有效。
對于例外情況，我需要將證書匯入瀏覽器。對于 Firefox，我首先得到了錯誤
You do not own the private key for the certificate
所以我創建了一個PKCS12檔案
openssl pkcs12 -export -inkey ./sample.key -in ./sample.crt -out ./sample.p12
and imported that one in Firefox under "My Certificates". That works, I host with ng serve "ssl/localhost.crt" and Firefox with the imported .p12 accepts my localhost. Now for MS Edge it still complains, my certificate is not valid.
I also tried .pfx-merging, but no change. I also read the certificates should not be installed under My Certificates but as Authorities. That sounds wrong to me but I tried it and imported both the .crt and the .p12 into Authorities and Root Authorities, because why not, but no change. I also installed the certificate through the Windows Wizard.
What am I missing for MS Edge? I sadly have no way around it.
===== Update =====
Additional information:
Edge does not give any helpful error. Here is an image of the message. It is in German but all it says is the default text "The connection is not secure. The certificate is invalid. Your credit card information might be stolen." If there is some way to get a more informative message for Edge I would be very happy. In the developer console the message is:
This site does not have a valid SSL certificate! Without SSL, your site's and visitors' data is vulnerable to theft and tampering. Get a valid SSL certificate before releasing your website to the public.
The certificate files and the output of openssl x509 -text localhost.crt can be viewed here (password is pass or password, if necessary) and an image of the .crt here. It is sitting in my development folder, I host the site with
ng serve --ssl true --ssl-cert \"ssl/localhost.crt\" --ssl-key \"ssl/localhost.key\"
and access the server locally through localhost:3000.
I imported the .p12 file into edge through manage certificates -> My Certificates -> Import. The result looks like this.
uj5u.com熱心網友回復：
MS Edge 缺少什么？一世
該證書不包含任何主題備用名稱，這使其對 Edge 和 Chrome 無效。嘗試指定這些資訊，但嘗試是錯誤的。
我按照本教程創建了一個自簽名證書。
看起來這個教程壞了。
openssl x509 -req ... -extensions "authorityKeyIdentifier ... subjectAltName=DNA:localhost"
-extension命令列選項用于在組態檔中給出擴展部分的名稱，而不是擴展本身。另外subjectAltName應該DNS:...不是DNA:...。
要修復創建一個my.ext包含您要使用的擴展名的擴展名檔案：
[myext]
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName=DNS:localhost
然后將此檔案用作擴展檔案-extfile my.ext并指定要使用的擴展名-extensions myext：
openssl x509 -req ... -extfile my.ext -extensions myext
轉載請註明出處，本文鏈接：https://www.uj5u.com/ruanti/445183.html