Chrome NET::ERR_CERT_AUTHORITY_INVALID

[oknoorap]

I'm using transparent proxy example. Chrome will block connection if certificate invalid. How to make it works

[elazarl]

Can you take a screenshot of the error message and paste it here?

I suspect the default certificate is SHA1, or bad in other ways.

[oknoorap]

where is default certificate?

[elazarl]

Can you click on the lock symbol in the URL line and take a screenshot?

Look at cert.go

[oknoorap]

I've updated image on previous post.

cert.go (just looks like your source) 😃

package goproxy

import (
    "crypto/tls"
    "crypto/x509"
)

func init() {
    if goproxyCaErr != nil {
        panic("Error parsing builtin CA " + goproxyCaErr.Error())
    }
    var err error
    if GoproxyCa.Leaf, err = x509.ParseCertificate(GoproxyCa.Certificate[0]); err != nil {
        panic("Error parsing builtin CA " + err.Error())
    }
}

var tlsClientSkipVerify = &tls.Config{InsecureSkipVerify: true}

var defaultTLSConfig = &tls.Config{
    InsecureSkipVerify: true,
}

var CA_CERT = []byte(`-----BEGIN CERTIFICATE-----
MIICSjCCAbWgAwIBAgIBADALBgkqhkiG9w0BAQUwSjEjMCEGA1UEChMaZ2l0aHVi
LmNvbS9lbGF6YXJsL2dvcHJveHkxIzAhBgNVBAMTGmdpdGh1Yi5jb20vZWxhemFy
bC9nb3Byb3h5MB4XDTAwMDEwMTAwMDAwMFoXDTQ5MTIzMTIzNTk1OVowSjEjMCEG
A1UEChMaZ2l0aHViLmNvbS9lbGF6YXJsL2dvcHJveHkxIzAhBgNVBAMTGmdpdGh1
Yi5jb20vZWxhemFybC9nb3Byb3h5MIGdMAsGCSqGSIb3DQEBAQOBjQAwgYkCgYEA
vz9BbCaJjxs73Tvcq3leP32hAGerQ1RgvlZ68Z4nZmoVHfl+2Nr/m0dmW+GdOfpT
cs/KzfJjYGr/84x524fiuR8GdZ0HOtXJzyF5seoWnbBIuyr1PbEpgRhGQMqqOUuj
YExeLbfNHPIoJ8XZ1Vzyv3YxjbmjWA+S/uOe9HWtDbMCAwEAAaNGMEQwDgYDVR0P
AQH/BAQDAgCkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8w
DAYDVR0RBAUwA4IBKjALBgkqhkiG9w0BAQUDgYEAIcL8huSmGMompNujsvePTUnM
oEUKtX4Eh/+s+DSfV/TyI0I+3GiPpLplEgFWuoBIJGios0r1dKh5N0TGjxX/RmGm
qo7E4jjJuo8Gs5U8/fgThZmshax2lwLtbRNwhvUVr65GdahLsZz8I+hySLuatVvR
qHHq/FQORIiNyNpq/Hg=
-----END CERTIFICATE-----`)

var CA_KEY = []byte(`-----BEGIN RSA PRIVATE KEY-----
MIICXQIBAAKBgQC/P0FsJomPGzvdO9yreV4/faEAZ6tDVGC+VnrxnidmahUd+X7Y
2v+bR2Zb4Z05+lNyz8rN8mNgav/zjHnbh+K5HwZ1nQc61cnPIXmx6hadsEi7KvU9
sSmBGEZAyqo5S6NgTF4tt80c8ignxdnVXPK/djGNuaNYD5L+4570da0NswIDAQAB
AoGBALzIv1b4D7ARTR3NOr6V9wArjiOtMjUrdLhO+9vIp9IEA8ZsA9gjDlCEwbkP
VDnoLjnWfraff5Os6+3JjHy1fYpUiCdnk2XA6iJSL1XWKQZPt3wOunxP4lalDgED
QTRReFbA/y/Z4kSfTXpVj68ytcvSRW/N7q5/qRtbN9804jpBAkEA0s6lvH2btSLA
mcEdwhs7zAslLbdld7rvfUeP82gPPk0S6yUqTNyikqshM9AwAktHY7WvYdKl+ghZ
HTxKVC4DoQJBAOg/IAW5RbXknP+Lf7AVtBgw3E+Yfa3mcdLySe8hjxxyZq825Zmu
Rt5Qj4Lw6ifSFNy4kiiSpE/ZCukYvUXGENMCQFkPxSWlS6tzSzuqQxBGwTSrYMG3
wb6b06JyIXcMd6Qym9OMmBpw/J5KfnSNeDr/4uFVWQtTG5xO+pdHaX+3EQECQQDl
qcbY4iX1gWVfr2tNjajSYz751yoxVbkpiT9joiQLVXYFvpu+JYEfRzsjmWl0h2Lq
AftG8/xYmaEYcMZ6wSrRAkBUwiom98/8wZVlB6qbwhU1EKDFANvICGSWMIhPx3v7
MJqTIj4uJhte2/uyVvZ6DC6noWYgy+kLgqG0S97tUEG8
-----END RSA PRIVATE KEY-----`)

var GoproxyCa, goproxyCaErr = tls.X509KeyPair(CA_CERT, CA_KEY)

[oknoorap]

howdy, is the status of this issue still open?

[elazarl]

Hi,
Unfortunately I do not have as much time to work on goproxy as I wish.
I'll try to close this issue by the end of this week.

Sorry and thanks,

[oknoorap]

okay no problem @elazarl enjoy your time, thanks and good luck.

[qZanity]

I'm also getting the same problem in Firefox latest version Windows 10.

Any update on this?

[elazarl]

Hi, I'm sorry for thus taking so long. I'll try to have a look today.

…

On Wed, Feb 22, 2017, 2:16 AM qZanity ***@***.***> wrote: I'm also getting the same problem in Firefox latest version Windows 10. Any update on this? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#142 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAP4op4TYBlsiee0pYArBP7L6Umh7NJ4ks5re35HgaJpZM4HP8it> .

[simodima]

Any update on this?

[elazarl]

Isn't it already solved?

…

On Thu, Apr 27, 2017, 1:08 PM Simone Di Maulo ***@***.***> wrote: Any update on this? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#142 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAP4oreXy4q2Jz-4T9qveurwbiW0vQ8Aks5r0GkpgaJpZM4HP8it> .

[peeyushsrj]

I had same problem. Well I got the solution. The certificate in this example is not self signed.
So I generate a new self signed certificate using https://golang.org/src/crypto/tls/generate_cert.go with -ca flag, performed the same procedure and it started working for me! 😄