I have a cert that include an X509v3 Subject Alternative setting, but Chrome 67.0.3396.99 is saying the Subject Alternative Name is missing even though it looks like it's included in the cert.
Here's the X509v3 portion of the cert as per openssl s_client -showcerts -connect www.mysite.org:443 </dev/null 2> /dev/null | openssl x509 -noout -text
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
X509v3 Subject Alternative Name:
DNS:www.mysite.org
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
<redacted>
The Subject of the cert is Subject: CN = www.mysite.org.
Am I missing some additional X509v3 setting that that Chrome's expecting so it'll accept the SAN ?
Chrome 67 is pretty old, but your cert has TWO BasicConstraint extensions which violates RFC5280 4.2, and if I replicate that error (by hand!) my up-to-date 71.0.3578.98 exhibits the same symptoms: NET::ERR_CERT_COMMON_NAME_INVALID and 'advanced' claims 'certificate does not specify Subject Alternative Names' -- even though if I 'proceed to $site (unsafe)' and then click the padlock and look at the cert it is confirmed to have SAN present and correct.
So whatever method was used to create this cert is broken somehow, but Chrome's handling is way suboptimal.
ADDED: per comments, here is my latest test data, where one-BC works and two-BC (both forms: critical and not) fails, with both Chrome and Firefox esr:
There were a few problems with my cert.
Here are some other random comments: