码农之家 - SSL
type: channel
link: http://blog.liyx.fun/index.php/tag/SSL/
items: win7 chrome net::ERR_CERT_AUTHORITY_INVALID
items: 生成Nginx SSL证书

win7 chrome net::ERR_CERT_AUTHORITY_INVALID
type: item
date: 2023-05-06T16:40:00+08:00
description: win7用chrome访问某些https网站时，只能加载文字，css和js文件不能加载，提示 net::ERR_CERT_AUTHORITY_INVALID 错误，点击地址栏左边的锁标识查看证书时，显示没有足够信息,不能验证该证书。这是由于系统没有证书颁发机构的根证书引起的。以 https://www.ilayuis.com 为例，证书是由 TrustAsia RSA DV TLS CA G2 颁发的，但系统没有该组织的根证书，只需要导入该组织的根证书即可，在证书路径查看最顶级的根证书名称。可以在网上查找到这个组织的根证书 AAA Certificate Services，然后下载下来。或者用win11的chrome打开这个网站，点地址栏左边的锁标识查看证书，选择证书详细信息，导出证书 AAA Certificate Services.crt，然后传到win7系统内。回到win7的chrome，打开 设置 -> 隐私设置和安全性 -> 管理证书，然后导入证书到 受信息的根证书颁发机构。重启chrome即可正常访问网站内容。

生成Nginx SSL证书
type: item
date: 2022-01-18T11:33:00+08:00
description: JSk的keytool执行命令:生成证书keytool -genkeypair -alias hqtest -keyalg RSA -keysize 2048 -validity 3650 -keypass 123456 -storepass 123456 -keystore D:/hqtest.keystore 证书转成p12格式keytool -importkeystore -srckeystore D:/hqtest.keystore -destkeystore D:/hqtest.p12 -srcstoretype JKS -deststoretype PKCS12 导出证书keytool -exportcert -file D:/hqtest.cer -alias hqtest -keystore D:/hqtest.keystore -storepass 123456 openssl执行命令:生成pem证书x509 -inform der -in D:\hqtest.cer -out D:\hqtest.pem 生成key文件pkcs12 -nocerts -nodes -in D:\hqtest.p12 -out D:\hqtest.key 生成证书交换文件dhparam -out D:\dhparam.pem 4096 Nginx配置：http{ server_tokens off; include mime.types; default_type application/octet-stream; gzip on; client_max_body_size 300m; server { #监听端口 listen 8612; #对应的域名 server_name 192.168.0.28; ssl on; ssl_certificate D:\hqtest.pem; ssl_certificate_key D:\hqtest.key; ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256::!MD5; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.4.4 8.8.8.8 valid=300s; resolver_timeout 5s; ssl_prefer_server_ciphers on; ssl_dhparam D:\dhparam.pem; add_header Strict-Transport-Security "max-age=31536000"; add_header Content-Security-Policy "upgrade-insecure-requests;connect-src *"; location / { proxy_pass http://127.0.0.1:8602; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } error_page 497 https://$host:$server_port$uri; } }