title: Rejected Client-Certificate in Chrome 61
body: <p>I have an already long running website secured by self generated client-certificates. It has been working for years without any problems with any browser like IE, Firefox and Chrome.</p>
  
  <p>Since the last Chrome Update (61.0.3163.100) the client certificates are rejected with following error message:</p>
  
  <pre><code>This site can’t provide a secure connection
  
  my.domain.com didn’t accept your login certificate, or one may not have been provided.
  Try contacting the system admin.
  ERR_BAD_SSL_CLIENT_AUTH_CERT
  </code></pre>
  
  <p>And the site continues to work fine with any other browser!
  And i can not find any relevant information out there.</p>
  
  <p>I assume that chrome just raised the minimal requirements for the client certificates, as it did for server certificates a few months ago. but i have no glue how to fix it.</p>
  
  <p>Any hint what is wrong with my certificates? </p>
  
  <p>many thanks</p>
  
  <h1>UPDATE 15DEC2017</h1>
  
  <p>I still had problems and did not find any answer out there.</p>
  
  <p>After a while i figured out that Chrome does not like the Client Certificates generated by <code>openssl ca</code>.</p>
  
  <p>I was generating the Certificates so:</p>
  
  <pre><code>openssl ca -config openssl.cnf -extensions client -batch -in test.req -out test.cer
  </code></pre>
  
  <p>I tried everything but i was not able to make it to work with Chrome, but again, it worked with all other Browsers.</p>
  
  <p>Now i am generating the Certificates so:</p>
  
  <pre><code>openssl x509 -req -in test.req -CA ca.cer -CAkey ca.key -extensions client -extfile openssl.cnf -CAserial ca.srl -out test.cer -sha256 
  </code></pre>
  
  <p>And it works, if i compare the out of <code>openssl x509 -in test.cer -noout -text</code>, there is <strong>NO</strong> difference!! So i am wondering what Chrome does not like of <code>openssl ca</code>.</p>
  
  <p>I would prefer to use <code>openssl ca</code> over <code>openssl x509</code> since i can not use CRLs and i prefer also <code>startdate/enddate</code> over <code>days</code>.</p>
  
  <p>Any ideas?</p>