Google Chrome reports NET::ERR_CERT_COMMON_NAME_INVALID due to missing Subject Alternative Names when accessing the RSA Identity Router Single-Sign On Portal
Originally Published: 2018-05-22
Article Number
Applies To
RSA Product/Service Type: Identity Router
Issue
NET::ERR_CERT_COMMON_NAME_INVALID
The screen will appear as shown below. The text that is blurred in the screenshot will be the domain name of the server you are accessing. This will either be your IDR's Portal page, or an intermediate server, such as an IWA server.
If you click the Advanced link on the page displayed by Chrome, additional information will be displayed, explaining that "[the server's] security certificate does not specify Subject Alternative Names."
Cause
If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead."
This change is also mandated by CA base requirements. See CA/Browser Forum 2012 Guidance on the Deprecation of Internal Server Names.
Accordingly, Google Chrome version 58 and later issues a warning when only the certificate's Common Name field is available to validate server identity. Chrome now supports only a subjectAltName (Subject Alternate Name or SAN) x.509 certificate extension of type dNSName for server identity.
Resolution
- Send a new certificate signing request to your CA. Discuss the request with your CA's administrator to make sure the signed certificate will include a subjectAltName extension of type dNSName.
- When you have the new certificate, follow the instructions to upload it as a new company certificate in the RSA Cloud Administration Console.
- A new public/private key pair is usually created when a new certificate is issued. If new keys have been created, the new private key file must also be uploaded.
- If there is a new CA certificate chain, the certificate chain must be uploaded. The new CA certificate chain will also need to be installed in the trust store of end user's devices.
Workaround
