Create a Self‑Signed SSL Certificate with OpenSSL and Secure Nginx Intranet Access

Requirement: internal network access via IP must use HTTPS without insecure warnings.

OpenSSL Self‑Signed Certificate

Install OpenSSL:

yum install openssl openssl-devel -y
mkdir -pv /etc/ssl/private

Generate key and CSR:

cd /etc/ssl/private/
openssl req -new -newkey rsa:2048 -sha256 -nodes -out 192.168.199.104.csr -keyout 192.168.199.104.key -subj "/C=CN/ST=Beijing/L=Beijing/O=Super Inc./OU=Web Security/CN=192.168.199.104"
openssl x509 -req -days 365 -in 192.168.199.104.csr -signkey 192.168.199.104.key -out 192.168.199.104.crt

Configure Nginx for SSL

Update Nginx configuration to use the generated certificate and key (see image).

nginx -t
nginx -s reload

Import the certificate into Chrome:

Copy 192.168.199.104.crt to Windows and import via Chrome → Settings → Privacy and security → Manage certificates → Import.

Firefox import steps are similar (illustrated in the image).

Chrome may still show “NET::ERR_CERT_COMMON_NAME_INVALID”. To fix, delete the previously imported certificate and add an extension file http.ext with the following content:

keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @SubjectAlternativeName

[SubjectAlternativeName]
IP.1 = 127.0.0.1
IP.2 = 192.168.199.104

Regenerate the certificate using the extension:

openssl req -new -newkey rsa:2048 -sha256 -nodes -out 192.168.199.104.csr -keyout 192.168.199.104.key -subj "/C=CN/ST=Beijing/L=Beijing/O=Super Inc./OU=Web Security/CN=192.168.199.104"
openssl x509 -req -days 365 -in 192.168.199.104.csr -signkey 192.168.199.104.key -out 192.168.199.104.crt -extfile http.ext

After reloading Nginx and clearing Chrome’s cache, import the new .crt file again; the insecure warning disappears.

Summary

Chrome requires an additional extension file with proper key usage and Subject Alternative Name entries.

Two commands generate the self‑signed certificate.

Import the .crt into Chrome’s trusted root certificate store.

Reload Nginx and clear browser cache before testing.