Browser shows invalid for one certificate signed by an interim CA, but does not for others reddit / selfhosted ---------------------------------------------------------------------- rocsci · 2023-11-10 19:39 I've created several certificates signed by the same interim local CA that I've imported into all my browsers. Interestingly the certificate generated for one Synology DSM portal shows invalid and another works just fine. I splitting my hairs trying to understand what has gone wrong. Screenshots from browser for **Valid Cert** [Valid Cert Details](https://preview.redd.it/ot0bvyhknkzb1.png?width=1 260&format=png&auto=webp&s=e30f117789c34745114a1027738a2bd2bb57ba04) [Interim CA info shown for valid cert](https://preview.redd.it/8p2e3yi pnkzb1.png?width=1107&format=png&auto=webp&s=74259f02f242fed4cc5c2b2c3 7a8fbfc270c4498) **Invalid Cert** [Cert Details of Invalid one](https://preview.redd.it/v0brq2ssnkzb1.pn g?width=1194&format=png&auto=webp&s=6e76ef715ee10a14c0445ab2ae39aa1f84 98d910) ​ [Interim CA info shown for invalid cert](https://preview.redd.it/bitwo haxnkzb1.png?width=1219&format=png&auto=webp&s=7fd984582e45f4f56d17b45 6cf8add975ba7ec97) As you can see Interim CA is identical for both and added in PC's trusted root certificates/intermediate CA. I'm not clear on what I'm doing wrong here. https://preview.redd.it/6t2czslkpkzb1.png?width=999&format=png&auto=we bp&s=6f021811d60f746db2dfe3d6b8cf7192346be6dc Curl reponses are identical for both websites https://preview.redd.it/d2jzh1abglzb1.png?width=1807&format=png&auto=w ebp&s=2cded1e0b1563239599c11169c8b79f561e8d518 ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 20:02 Access syncroverse.infv in your browser on https (TCP:443) not TCP:5001 like on your screenshot (just like you did correct with curl) and check if the browser still complains. ---------------------------------------------------------------------- rocsci · 2023-11-10 20:16 Synology web portal (DSM) is hosted on port 5001. So even if I were to access 443, it redirects to 5001. Updated the post with curl to port 5001 ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 21:10 Curl is not your browser, set the https port on Synology to 443 and try it. For example, after iOS 17 update, if you enter an IP in Safari it will always add www. In front of it, if you access a FQDN that points to an internal IP, nothing is visible, you have to “Reduce Protection” to actually see your internal FQDN with a legit (not own CA) cert, so maybe your browser does something similar and “protects” you from SSL via port :5001, just try it, it doesn’t hurt. ---------------------------------------------------------------------- Thijn41 · 2023-11-10 21:16 What does curl say for the site that's not working? (The screenshot shows the same 2 sites) And what error do you get in the browser? ---------------------------------------------------------------------- Thijn41 · 2023-11-10 21:18 The port isn't the problem. His domain that's working is using port 5001 as well. ---------------------------------------------------------------------- rocsci · 2023-11-10 22:07 Yes, I tried Brave and Edge. Have the same issue. Both dont show SSL errors for other sites ---------------------------------------------------------------------- rocsci · 2023-11-10 22:09 My bad. Updated the screenshot. Both sites show the same output