Google-chrome – How to add a self-signed certificate as an exception in Chrome

Maybe try importing that certificate into your system's certificate store and trust it. Chrome uses the OS to validate the security certificate.

I think it is very understandable that Chrome gives you an error instead a warning when the proxy's certificate is invalid because the proxy feature is probably implemented as a transparent add-on to its networking components. Requiring an additional UI to confirm the certificate of the proxy does not seem to be a useful feature.

The following steps will do the trick:

1. Generate the key and the certificate:

   openssl genrsa -out key.pem 1024
   openssl req -new -key key.pem -subj "/CN=localhost" -out req.pem
   openssl x509 -req -days 30 -in req.pem -signkey key.pem -out cert.pem
   

   Note that the only mandatory field is CN (CommonName) and must be the same domain of the one of the proxy.

2. Add the certificate to the system database using certutil (from package libnss3-tools in Debian):

   certutil -d "sql:$HOME/.pki/nssdb" -A -n dummy -i cert.pem -t C
   

   dummy is just a nickname and can be anything, but make sure to provide the -t C option.

Thanks to all the comments so far. After some tweaking around I stumbled upon this which was very helpful to me: http://forum.synology.com/enu/viewtopic.php?f=145&t=77919

The NAS actually creates 2 types of certificates, one for the website, and one for the root authority.

It first tries to identify the website's certificate. Upon inspection it sees that the certificate has been issued by a particular Certification Authority. You can't simply install the website's certifcate. You need to actually install the CA's certificate generated by the NAS.

Upon doing this I closed Chrome using the X button. That didn't work. I did this a couple more times, and then I used the chrome "Exit" menu. This worked! So lesson learned... X does not necessarily restart Chrome.

This is now resolved!