Self Sign Cert

Self Sign Certificate on your private network like a NAS to encrypt administration logon

=====================

Error message: NET::ERR_CERT_AUTHORITY_INVALID

#1 Download and install OpenSSL on your root drive, like c:\OpenSSL

#2 Create New Self Sign Certificate, using configuration file 'openssl.cnf' below and command line like
openssl req -x509 -new -nodes -days 3650 -keyout nas2.key -out nas2.pem -config openssl.cnf

Of course, update these lines:

[ req_dn ]

countryName            = MyCountry

stateOrProvinceName    = MyDistrict
organizationName       = MyFirm
commonName             = MyDings

[alt_names]
DNS.1 = MyDings1
DNS.2 = MyDings2
DNS.3 = MyDings3

etc

#3 After Creating cert and key, import them to your certmgr

#4 Then import them to you NAS

#5 Still not working in browser. open an inPrivate/Inconito Window and go to your URL. Now it should work. Go back to your normal browser Window and try again!

Sample 'openssl.cnf'

######################################################
# OpenSSL config to generate a self-signed certificate
#
# Create certificate with:
# openssl req -x509 -new -nodes -days 3650 -keyout selfsigned.key -out selfsigned.pem -config openssl.cnf
#
# Remove the -nodes option if you want to secure your private key with a passphrase
#
######################################################
################ Req Section ################
# This is used by the `openssl req` command
# to create a certificate request and by the
# `openssl req -x509` command to create a
# self-signed certificate.
[ req ]
# The size of the keys in bits:
default_bits       = 2048

# The message digest for self-signing the certificate
# sha1 or sha256 for best compatability, although most
# OpenSSL digest algorithm can be used.
# md4,md5,mdc2,rmd160,sha1,sha256
default_md = sha256

# Don't prompt for the DN, use configured values instead
# This saves having to type in your DN each time.
prompt             = no
string_mask        = default
distinguished_name = req_dn
# Extensions added while singing with the `openssl req -x509` command
x509_extensions = x509_ext

[ req_dn ]
countryName            = NO
stateOrProvinceName    = MyDistrict
organizationName       = MyFirm
commonName             = MyDings

[ x509_ext ]
subjectKeyIdentifier    = hash
authorityKeyIdentifier  = keyid:always
# No basicConstraints extension is equal to CA:False
# basicConstraints      = critical, CA:False
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = MyDings1

But, can I not use Powershell?

Of course you can!

New-SelfSignedCertificate -DnsName "MyDings,MyDings1"

You can even use an IP-address in addition to DNS-name:

New-SelfSignedCertificate -TextExtension @("2.5.29.17={text}IPAddress=10.0.0.100&DNS=MyDings&DNS=MyDings1")