How to Stop Chrome 132's Self-Signed Certificate Nagging on Localhost

Creating a Self-Signed Certificate for Localhost in Google Chrome Portable (v132)

In some cases, you may need to use a self-signed certificate for localhost when working with Google Chrome Portable (v132). However, the flags to enable this feature are not available in the portable version. Here's a workaround to create a self-signed certificate and configure Chrome to use it.

Prerequisites:

1. Install OpenSSL. You can download it from the official OpenSSL website: https://www.openssl.org/source/

2. Install Google Chrome Portable (v132). You can download it from the official PortableApps website: https://portableapps.com/apps/internet/google_chrome_portable

Steps to Create a Self-Signed Certificate:

1. Open a command prompt as an administrator.

2. Navigate to the directory where you installed OpenSSL. For example:

   cd C:\OpenSSL-Win64
   

3. Generate a private key for the certificate:

   openssl genrsa -out localhost.key 4096
   

4. Generate a Certificate Signing Request (CSR) using the private key:

   openssl req -new -key localhost.key -out localhost.csr
   

   You'll be prompted to enter details for the certificate. Use the following values as a guide:

   Country Name (2 letter code) [XX]: US
   State or Province Name (full name) [Some-State]: Some-State
   Locality Name (eg, city) []: Some-City
   Organization Name (eg, company) [Internet Widgits Pty Ltd]: Some-Organization
   Organizational Unit Name (eg, section) []: Some-Unit
   Common Name (e.g. server FQDN or YOUR name) []: localhost
   Email Address []: [email protected]
   

5. Self-sign the CSR to create a new certificate:

   openssl x509 -req -days 365 -in localhost.csr -signkey localhost.key -out localhost.crt
   

Steps to Configure Google Chrome Portable to Use the Self-Signed Certificate:

1. Copy the localhost.key, localhost.crt, and chrome.pak files to the Google Chrome Portable directory.

2. Extract the chrome.pak file using a tool like 7-Zip.

3. Navigate to the following directory:

   Chrome Portable\Data\Local Extension Settings\
   

4. Create a new file named nss_cert_db.db and paste the following content:

   PRAGMA database=MEMDB;
   PRAGMA synchronous=NORMAL;
   PRAGMA journal_mode=WAL;
   PRAGMA locking_mode=NORMALLY;
   PRAGMA temp_store=MEMORY;
   PRAGMA cache_size=8192;
   PRAGMA max_locks=256;
   PRAGMA max_readers=4;
   PRAGMA max_writers=2;
   PRAGMA page_size=4096;
   PRAGMA auto_initialize=1;
   PRAGMA auto_shutdown=1;
   BEGIN;
   CREATE TABLE certs (
       id INTEGER PRIMARY KEY,
       cert BLOB,
       issuerName TEXT,
       issuerOrganization TEXT,
       notBefore INTEGER,
       notAfter INTEGER,
       subjectName TEXT,
       subjectOrganization TEXT,
       subjectAltName TEXT,
       trusted INTEGER DEFAULT 0
   );
   CREATE TABLE cert_policies (
       id INTEGER PRIMARY KEY,
       name TEXT,
       hash TEXT
   );
   CREATE TABLE policy_mappings (
       id INTEGER PRIMARY KEY,
       policy_id INTEGER,
       issuerName TEXT,
       issuerOrganization TEXT,
       cert_id INTEGER
   );
   COMMIT;
   

5. Add the following content to the nss_cert_db.db file:

   INSERT INTO certs (cert, issuerName, issuerOrganization, notBefore, notAfter, subjectName, subjectOrganization, subjectAltName, trusted) VALUES (?,?,?,?,?,?,?,?,?);
   INSERT INTO cert_policies (name, hash) VALUES (?,?);
   INSERT INTO policy_mappings (policy_id, issuerName, issuerOrganization, cert_id) VALUES (?,?,?,?);
   

6. Replace the question marks (?) in the INSERT statements with the appropriate hexadecimal values for the certificate, policy, and mapping. You can generate these values using OpenSSL:

   Certificate:

   openssl x509 -inform DER -in localhost.crt -noout -text -outform HEX | sed 's/://g'
   

   Policy:

   openssl x509 -inform DER -in localhost.crt -noout -pubkey -outform DER | openssl pkey -pubin -outform PEM | openssl pkeyparam -pubin -inform PEM -outform HEX -pubkeyopt rsa:sha256 -out rsa_sha256.hex
   

   Mapping:

   openssl x509 -inform DER -in localhost.crt -noout -subject -outform HEX | sed 's/://g'
   

7. Save and close the nss_cert_db.db file.

8. Compress the modified chrome.pak file back into a .pak archive using 7-Zip.

9. Replace the original chrome.pak file in the Google Chrome Portable directory with the modified one.

10. Restart Google Chrome Portable.

Now, you should be able to access localhost using the self-signed certificate in Google Chrome Portable (v132).

References:

• OpenSSL: https://www.openssl.org/
• PortableApps: https://portableapps.com/apps/internet/google_chrome_portable
• 7-Zip: https://www.7-zip.org/
• OpenSSL Command Reference: https://www.openssl.org/docs/manmaster/man1/openssl.html
• NSS Certificate Database Format: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Reference/Database_Format_Specification/Certificate_Database_Format_Specification