Generating self signed certificate for root domain and all subdomains considering Chrome's 58 security update

self-signed-certificate-chrome-58.md

Generating self signed certificate for root domain and all subdomains considering Chrome's 58 security update

Chrome 58 dropped Common Name support checking in SSL certs. Now it uses Subject Alternative Name field.

To generate new self signed certificate for root domain and all subdomains for example.local domain considering Chrome's 58 security update do:

openssl req \
        -newkey rsa:2048 \
        -x509 \
        -nodes \
        -keyout -.example.local.key \
        -new \
        -out -.example.local.crt \
        -reqexts SAN \
        -extensions SAN \
        -config <(cat /etc/ssl/openssl.cnf <(printf '[SAN]\nsubjectAltName=DNS:*.example.local, DNS:example.local')) \
        -sha256 \
        -days 365

Answer on all questions as you want, but in Common Name say: *.example.local/CN=example.local.

Tested with nginx, apache, Windows XP, Linux, OS X, IE8+.