I'm trying to learn about certificate generation, signing and what it takes to become a CA.
I am developing a HTTP proxy, which will be a middle proxy between browser and actual web server, and it will be used to record the HTTPS messages send received between browser and actual web server.
I need to generate dynamic certificates for domains browsed in browser in HTTP proxy that I am developing in a Ubuntu 14 64 bit machine. I want chrome should work smoothly while browsing various sites.
What I have done so far:
Created key and self signed certificate for CA using below commands.
certtool --generate-privkey --outfile ca-key.pem certtool --generate-self-signed --template cert.cfg --load-privkey ca-key.pem --outfile ca-cert.pem
Explicitly set ca certificate in system cert store.
Converted pem to crt certificate using below command
openssl x509 -in ca-cert.pem -inform PEM -out ca-cert.crt
(I need to find the corresponding command in certtool)
/usr/share/ca-certificates/extrapath and executed below command to set ca certificate in system explicitly.
sudo dpkg-reconfigure ca-certificates
With this I get a system window, I select
ca-cert.crtand press Ok to set certificate explicitly in system. My understanding is that since ca-cert.crt is set in system explicitly any other certificates signed by this ca-cert and ca-key will be trusted in system (except applications using their own cert store like firefox).
Next I created key for HTTP proxy using below command:
certtool --generate-privkey --outfile key.pem
Then I created csr for HTTP proxy using below command.
certtool --generate-request --load-privkey key.pem --template cert.cfg --outfile request.pem*
Then I signed the csr using below command.
certtool --generate-certificate --load-request request.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template cert.cfg --outfile cert.pem
Finally I have cert.key and cert.pem. Now these certificate files are used for communication between browser and my HTTP proxy.
I see that Chrome does not show the contents received.
However if I start Chrome with
ignore-certificate-errors mode, then Chrome works fine and shows the content in site properly.
Can somebody guide me as to what I'm doing wrong that's causing Chrome not to show the contents received?