title: Creating Root and Server certificates via openssl to enable https on web server shows Not Secure on Chrome Browser – so HTTPS is not working
body: <p>We have a web service application in which we perform the following procedure to generate certificates:</p>
  
  <p>1.Create a file named openssl.ini in the folder with the following content:</p>
  
  <pre><code># OpenSSL configuration file.
  #----Begin----
  # Establish working directory.
  dir                            = .
  
  [ ca ]
  default_ca                     = CA_default
  
  [ CA_default ]
  serial                         = $dir/serial
  database                       = $dir/index.txt
  new_certs_dir                  = $dir/newcerts
  certificate                    = $dir/cacert.pem
  private_key                    = $dir/private/cakey.pem
  default_days                   = 3650
  default_md                     = md5
  preserve                       = no
  email_in_dn                    = no
  nameopt                        = default_ca
  certopt                        = default_ca
  policy                         = policy_match
  
  [ policy_match ]
  countryName                    = match
  stateOrProvinceName            = match
  organizationName               = match
  organizationalUnitName         = optional
  commonName                     = supplied
  emailAddress                   = optional
  
  [ req ]
  default_bits                   = 1024 # Size of keys
  default_keyfile                = key.pem # name of generated keys
  default_md                     = md5 # message digest algorithm
  string_mask                    = nombstr # permitted characters
  distinguished_name             = req_distinguished_name
  
  [ req_distinguished_name ]
  # Variable name Prompt string
  #---------------------- ----------------------------------
  0.organizationName             = Organization Name (company)
  organizationalUnitName         = Organizational Unit Name (department, division)
  emailAddress                   = Email Address
  emailAddress_max               = 40
  localityName                   = Locality Name (city, district)
  stateOrProvinceName            = State or Province Name (full name)
  countryName                    = Country Name (2 letter code)
  countryName_min                = 2
  countryName_max                = 2
  commonName                     = Common Name (hostname, IP, or your name)
  commonName_max                 = 64
  # Default values for the above, for consistency and less typing.
  # Variable name Value
  #------------------------------ ------------------------------
  0.organizationName_default     = XYZ Corp
  countryName_default            = US
  stateOrProvinceName_default    = CA
  localityName_default           = San Francisco
  emailAddress_default           = support@xyz.com
  organizationalUnitName_default = Business Division
  commonName_default             = ServerSystem1
  
  [ v3_ca ]
  basicConstraints               = CA:TRUE
  subjectKeyIdentifier           = hash
  authorityKeyIdentifier         = keyid:always,issuer:always
  keyUsage                       = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
  
  [ v3_req ]
  basicConstraints = CA:FALSE
  keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign
  #----End----
  </code></pre>
  
  <p>2.Run the following Openssl commands to generate the RootCA and Server certificate</p>
  
  <pre><code>md ServerCert
  cd ServerCert
  md newcerts private
  copy ..\openssl.ini ServerCert
  
  echo 01 &gt; serial
  copy /y nul index.txt
  
  openssl genrsa -out private/cakey.pem 1024
  openssl req -new -x509 -extensions v3_ca -key private/cakey.pem -out cacert.pem -days 3650 -config ./openssl.ini
  openssl x509 -in cacert.pem -out ServerCA.crt
  
  openssl req -new -nodes -out req.pem -extensions v3_req -config ./openssl.ini
  
  openssl ca -out cert.pem -extensions v3_req -config ./openssl.ini -infiles req.pem
  
  move cert.pem tmp.pem
  openssl x509 -in tmp.pem -out cert.pem
  
  openssl rsa -in key.pem -inform PEM -out ServerKey.der -outform DER
  openssl x509 -in cert.pem -inform PEM -out ServerCert.der -outform DER
  </code></pre>
  
  <p>At the end of the process, the 3 files that are used later are:</p>
  
  <ol>
  <li>ServerCA.crt -> Used on Windows to trust the webserver application </li>
  <li>ServerKey.der -> Key used by the webserver</li>
  <li>ServerCert.der -> Certificate used by the webserver application</li>
  </ol>
  
  <p>The web server application requires the DER files to send the certificates. But in the browser, upon running the web-service application, the browser shows “Not Secure” warning.</p>
  
  <p><a href="https://i.stack.imgur.com/FLf8B.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FLf8B.png" alt="enter image description here"></a></p>
  
  <p>Upon clicking on the “Not Secure” warning, the following message is displayed.</p>
  
  <p><a href="https://i.stack.imgur.com/28F8R.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/28F8R.png" alt="enter image description here"></a></p>
  
  <p>However upon clicking on the Certificate and navigating to the tab “certification path”, the message says “This certificate is OK”.</p>
  
  <p><a href="https://i.stack.imgur.com/rovZA.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/rovZA.png" alt="enter image description here"></a></p>
  
  <p>This message is the same for Root Certificate and Server Certificate.
  How to change the procedure to generate the certificates or modify the .ini file, so that the web-server application is trusted by the Browser?</p>
  
  <p><strong>Question Update:</strong></p>
  
  <p>To install the certificate in the Windows Trust store, i followed the following steps:</p>
  
  <ol>
  <li>Typed "<strong>mmc</strong>" from command prompt(administrator)</li>
  <li>Clicked on "<strong>File</strong>" -> "<strong>Add/Remove snap-in...</strong>"</li>
  <li>Clicked on "<strong>Certificate</strong>" -> "<strong>Add</strong>" -> "<strong>Computer Account</strong>" -> "<strong>Next</strong>" -> "<strong>Finish</strong>"</li>
  <li>Clicked on "<strong>Certificates</strong>" -> "<strong>Trusted Root Certification Authorities</strong>" -> "<strong>Certificates</strong>"</li>
  <li>Right clicked on "<strong>Certificates</strong>"</li>
  <li>Clicked on "<strong>All tasks</strong>" -> "<strong>import</strong>" -> "<strong>Next</strong>" -> "<strong>Browse</strong>" -> <strong>Selected the CRT file</strong></li>
  </ol>