如何将localhost自签名Apache证书的红色HTTPS转为绿色安全标识

Hey there, let's tackle why your self-signed Apache cert is showing that red "Not Secure" warning, and how to flip it to that nice green HTTPS padlock.

Why the Red Warning? #

Browsers only trust certificates signed by pre-installed, globally recognized root Certificate Authorities (CAs). A self-signed certificate doesn't have that validation stamp, so browsers flag it as untrusted—even though it's your own local setup.

Method 1: Add Your Self-Signed Cert to Trusted Roots #

This is the quickest fix for a single local certificate:

1. Locate your existing certificate file
   Find the .crt or .pem file you used for Apache (usually named something like server.crt in your Apache ssl directory).

2. Add it to your system's trusted root CA store

   • Windows: Press Win+R, type certmgr.msc to open Certificate Manager. Navigate to Trusted Root Certification Authorities > Certificates, right-click, select All Tasks > Import, and follow the wizard to select your cert file.
   • macOS: Double-click your cert file to open Keychain Access. Find the cert in the Login keychain, right-click it, select Get Info, expand the Trust section, and set When using this certificate to Always Trust.
   • Linux (Ubuntu/Debian): Copy your cert to /usr/local/share/ca-certificates/, then run sudo update-ca-certificates to update the system trust store.

3. Optional: Add directly to your browser (if system trust doesn't stick)

   • Chrome: Go to Settings > Privacy and Security > Security > Manage certificates, switch to the Trusted Root Certification Authorities tab, click Import, and select your cert.
   • Firefox: Go to Options > Privacy & Security > Certificates > View Certificates, switch to the Authorities tab, click Import, select your cert, and check "Trust this CA to identify websites".

After this, restart your browser and reload localhost—you should see the green padlock.

Method 2: Create a Local CA (More Scalable for Multiple Local Services) #

If you plan to run multiple local HTTPS services, setting up your own local CA is a cleaner approach. Here's how:

1. Generate your local root CA key and certificate
   Open a terminal and run these commands (replace passwords and details as needed):

   # Create a password-protected CA private key
   openssl genrsa -des3 -out rootCA.key 2048
   # Generate a 10-year root certificate (Common Name can be "Local Root CA")
   openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.pem
   

2. Add the root CA cert to your system/browser trust store
   Follow the same steps from Method 1, but import rootCA.pem instead of your server cert. This tells your system to trust any cert signed by this local CA.

3. Generate a server certificate request (CSR) and private key for localhost

   # Create server private key
   openssl genrsa -out localhost.key 2048
   # Generate CSR (make sure Common Name is exactly "localhost")
   openssl req -new -key localhost.key -out localhost.csr
   

4. Create a config file for the server cert (to add Subject Alternative Names)
   Create a file named localhost.ext with this content:

   authorityKeyIdentifier=keyid,issuer
   basicConstraints=CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   subjectAltName = @alt_names
   
   [alt_names]
   DNS.1 = localhost
   DNS.2 = 127.0.0.1
   

   This ensures the cert works for both localhost and the loopback IP.

5. Sign the server CSR with your local CA

   openssl x509 -req -in localhost.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out localhost.crt -days 365 -sha256 -extfile localhost.ext
   

6. Update Apache config to use the new cert
   Edit your Apache SSL config (usually httpd-ssl.conf or ssl.conf):

   SSLCertificateFile "/path/to/localhost.crt"
   SSLCertificateKeyFile "/path/to/localhost.key"
   

   Restart Apache with sudo systemctl restart apache2 (Linux) or via the Services panel (Windows).

Important Notes #

• Even after trusting, some browsers might show a small note like "Certificate issued by unknown authority"—this is normal for local CAs, but the padlock will still be green.
• Never use self-signed or local CA certs in production—only for local development/testing. For production, use a globally trusted CA like Let's Encrypt.

内容的提问来源于stack exchange，提问作者The Winter Soldier