Chrome on macOS Catalina shows ERR_CERT_REVOKED for certs with validity over 825 days

[RandomByte]

Chrome on macOS Catalina will display an ERR_CERT_REVOKED error for locally signed certificates with a validity exceeding 825 days that are issued after July 2019.

Also see:

• https://podtech.io/os/mac-osx/chrome-catalina-certificate-issue/
• https://support.google.com/chrome/thread/14551925?hl=en

Since this module generates certificates with a validity of 7000 days, Chrome will reject them with the error ERR_CERT_REVOKED.

I tested changing the days parameter to -days 825 here:
https://github.com/guybedford/devcert/blob/master/src/openssl.ts#L157

And the resulting certificate is accepted as valid by Chrome.

➡️ Would it be possible to change the default or alternatively add a parameter to specify the days the certificate should be valid?

If it would speed up things I can also create a PR for the accepted solution.

[guybedford]

Sounds like a sensible fix to me. This wasn’t a limit while I was developing the project. A PR would help a lot to ensure it’s working right. Will gladly publish a patch from that.

…

On Tue, Dec 10, 2019 at 07:43 Merlin Beutlberger ***@***.***> wrote: Chrome on macOS Catalina will display an ERR_CERT_REVOKED error for locally signed certificates with a validity exceeding 825 days that are issued after July 2019. Also see: - https://podtech.io/os/mac-osx/chrome-catalina-certificate-issue/ - https://support.google.com/chrome/thread/14551925?hl=en Since this module generates certificates with a validity of 7000 days, Chrome will reject them with the error ERR_CERT_REVOKED. I tested changing the days parameter to -days 825 here: https://github.com/guybedford/devcert/blob/master/src/openssl.ts#L157 And the resulting certificate is accepted as valid by Chrome. ➡️ Would it be possible to change the default or alternatively add a parameter to specify the days the certificate should be valid? If it would speed up things I can also create a PR for the accepted solution. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#4?email_source=notifications&email_token=AAESFSQAOEGMAOMKEVFQALTQX6FIVA5CNFSM4JY54BU2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4H7OHINQ>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAESFSRI76Y2EX6NSSKYYTTQX6FIVANCNFSM4JY54BUQ> .