Error “net::ERR_CERT_AUTHORITY_INVALID” for self-signed certificate (SOLVED)

Contents

1. net::ERR_CERT_AUTHORITY_INVALID on a local web server
2. What causes the net::ERR_CERT_AUTHORITY_INVALID error
3. How to fix the net::ERR_CERT_AUTHORITY_INVALID error in Linux

net::ERR_CERT_AUTHORITY_INVALID on a local web server

This article is dedicated to fixing the error “net::ERR_CERT_AUTHORITY_INVALID” for a certificate that you generated on your computer for the purpose of testing HTTPS. That is, here we will show how to fix the error on a local web server.

If you encounter such an error when visiting a website on the Internet, then remember that in this case you should not enter any passwords or personal data on this site, since you must assume that the data is transmitted in unencrypted form or is deliberately intercepted by an attacker. Or just close the problematic site.

So, let's go back to our local web server. You've created a self-signed certificate and configured your web server to work over HTTPS, but your web browser reports a net::ERR_CERT_AUTHORITY_INVALID error.

What causes the net::ERR_CERT_AUTHORITY_INVALID error

The essence of the error is that the certificate is signed by a Certification Authority (CA) that your web browser does not trust. As a result, when you open a website, you will see the following message:

Your connection is not private
Attackers might be trying to steal your information from hackware.local (for example, passwords, messages, or credit cards). Learn more about this warning
net::ERR_CERT_AUTHORITY_INVALID
Turn on enhanced protection to get Chrome's highest level of security
This server could not prove that it is hackware.local; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.

Proceed to hackware.local (unsafe)

Since the certificate for the local website is most likely signed using the CA keys that you created yourself, there is only one way out of this situation – add the Certification Authority you created to the trusted ones. This will lead to the fact that any certificates that you sign with this Certification Authority will be perceived as reliable.

How to fix the net::ERR_CERT_AUTHORITY_INVALID error in Linux

Chrome, Chromium, Firefox and web browsers based on them do NOT trust root certificates installed at the system level.

And although these browsers use NSS, they ignore system-wide NSS certificates that can be added to the /etc/pki/nssdb file!

Firefox, Thunderbird, Chromium, Chrome and other applications that use NSS store their lists of trusted certificates in cert9.db files. Each of these programs has its own cert9.db file. You can use a script to add your certificate to each of these files.

Save the following code to the CAtoCert9.sh file:

#!/bin/bash
 
certfile="/home/mial/myCA/rootCA.crt"
certname="HackWare CA"
 
for certDB in $(find ~/ -name "cert9.db")
do
    certdir=$(dirname ${certDB});
    certutil -A -n "${certname}" -t "TCu,Cu,Tu" -i ${certfile} -d sql:${certdir}
done

In this file, change the certfile value to the file name of your certificate and the certname value to the name of your certificate, save and close the file.

Please note that certfile should NOT be the website certificate, but the certificate (public key) of the local Certification Authority!

Then run it as follows:

bash ./CAtoCert9.sh

As a result, all cert9.db files will be found in the user's home folder and the specified CA certificate will be added to each of them.

You don't need to restart the web server. It is enough to reload the web page (preferably with Ctrl+F5).

As you can see, the problem is now solved.

To remove certificates added with the script above, create a file called CAfromCert9.sh and copy the following into it:

#!/bin/bash

certname="HackWare CA"

for certDB in $(find ~/ -name "cert9.db")
do
	certdir=$(dirname ${certDB});    
	certutil -D -d sql:${certdir} -n "${certname}"
done

In this file, change the certname value to the name of your certificate, save and close the file.

Then run it like this:

bash ./CAfromCert9.sh