I'm trying to figure out why Chromium is not happy with a TLS certificate, and how to fix it:After upgrading & restarting Chromium (now 58.0.3029.81, running on Debian testing), I can no longer access our internal GitLab server (installed on Debian Jessie, via the omnibus package). I get:Your connection is not privateAttackers might be trying to steal your information from git.ourdomain.net (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALIDThe certificate is signed with our internal CA, which is installed in the system store (by putting it in /usr/local/share/ca-certificates). I checked the site with both Firefox 52 and openssl s_client -verify 5 -verify_return_error -connect git.ourdomain.net:443; both are happy. OpenSSL shows the chain as:Certificate chain 0 s:/C=US/ST=Virginia/L=Sterling/O=us/OU=Servers/CN=git.ourdomain.net   i:/C=US/ST=Virginia/L=Sterling/O=us/CN=us Certification Authority/emailAddress=ca@ticket.ourdomain.netBoth OpenSSL and Firefox show strong signing (SHA-512) and ciphers (AES-GCM). The certificate (according to openssl x509 -text) is sha512WithRSAEncryption, with a 4096-bit RSA key. It has a Netscape Cert Type of SSL Client, SSL Server.Note: us and ourdomain.net are redactions; the actual output has our company name for us and our actual domain for ourdomain.net. I carefully checked that all the ourdomain.net actually match.As far as I can tell, there is nothing wrong with the certificate, and the common name (git.ourdomain.net) is perfectly valid and matches the URLso what is Chromium complaining about? And, presuming it's not a real issue, is there some way to override it?
What does Chromium NET::ERR_CERT_COMMON_NAME_INVALID mean?
chrome;ssl;https
It appears from Chromium bug 308330 that they believe there is a risk of a false match when matching hostnames to certificate common names, and thus have disabled that. Chromium will now only match against the subjectAltName extension. Firefox made a similar change, but limited it to only newer certificates issued by public CAs, not internal ones. That's why Firefox still works.The Chromium change can be overridden by setting the policy EnableCommonNameFallbackForLocalAnchors, which can be creating /etc/chromium/policies/managed/use-common-names.json with content like:{    EnableCommonNameFallbackForLocalAnchors: true}It seems that you have to restart Chromium after creating that.