X509v3 Subject Alternative Name must be critical

[seregaizsbera]

Environment

• Operating system (including version):
  any

• mkcert version (from mkcert -version):
  1.4.4

• Server (where the certificate is loaded):
  any

• Client (e.g. browser, CLI tool, or script):
  OpenDJ 3.5

What you did

Consider legacy soft that expected the server name to match certificate's common name.

What went wrong

That soft issues verification error, since real name of the server resides in SAN Extension.

The Certificate presented by the server example.com could not be trusted. There is a name mismatch between the name of the server (example.com) and the subject DN of the certificate. This could be caused because you are connected to a server pretending to be example.com. Before accepting this certificate, you should examine the server's certificate carefully.

Expected result

If mkcert doesn't allow deprecated usage of common name field in subject, it must specify, that SAN extension is critical, so that legacy soft doesn't try to use it in deprecated way. The error message would be something like 'unsupported certificate purpose'.