Certificate error since Chrome 58 - NET::ERR_CERT_COMMON_NAME_INVALID

Issue details

Since Chrome 58, self-signed certificates can cause the following message to appear…

Your connection is not private

Attackers might be trying to steal your information from localhost (for example, passwords, messages or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID

This server could not prove that it is localhost; its security certificate is from [missing_subjectAltName]. This may be caused by a misconfiguration or an attacker intercepting your connection.

Details on why this has suddenly started happening can be found here - https://textslashplain.com/2017/03/10/chrome-deprecates-subject-cn-matching/

Info on creating certificates with the SubjectAltName set correctly can be found here - http://fbcs.co.uk/self-signed-multiple-domain-ssl-certificates/

Steps to reproduce/test case

Update to Chrome 58

Please specify which version of Browsersync, node and npm you’re running

• Browsersync [ dev-master ]
• Node [ 6.9.1 ]
• Npm [ 3.10.8 ]

Affected platforms

• linux
• windows
• OS X
• freebsd
• solaris
• other (please specify which)

Browsersync use-case

• API
• Gulp
• Grunt
• CLI

If CLI, please paste the entire command below

{cli command here}

for all other use-cases, (gulp, grunt etc), please show us exactly how you’re using Browsersync

gulp.task('browser-sync', function() {
		browserSync.init({
			ui: false,
			proxy: "https://www.xxxxxx.dev",
			injectChanges: true,
			ghostMode: false
		});
	});

[glambert]

In the mean time, you can allow-insecure-localhost in chrome flags:

chrome://flags/#allow-insecure-localhost

Found here: https://productforums.google.com/d/msg/chrome/sTyLejkD8NQ/bhAhmHIzAgAJ

[shakyShane]

Great, thanks - I’ll look into it then 😃