title: What is the correct way to generate a selfsigned cert for *.localhost ('wildcard')
body: <p>I can't for the life of me get chrome to work with a wildcard cert (&quot;*.localhost&quot;)</p>
  <p>Here is what I'm doing to generate said cert.</p>
  <p>First I gen my ca</p>
  <pre><code>openssl genrsa -out priv/cert/ca.key 2048
  openssl req -new -x509 -nodes -subj &quot;/C=US/O=_Development \
  CA/CN=Development certificates&quot; -key priv/cert/ca.key -sha256 \
  -days 3650 -out priv/cert/ca.crt
  </code></pre>
  <p>Then I gen my localhost</p>
  <pre><code>openssl genrsa -out priv/cert/localhost.key 2048
  openssl req -new -subj &quot;/C=US/O=Local Development/CN=*.localhost&quot; -key \
  priv/cert/localhost.key -out priv/cert/localhost.csr
  </code></pre>
  <p>Then I make my ext file</p>
  <pre><code>authorityKeyIdentifier=keyid,issuer
  basicConstraints=CA:FALSE
  keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
  extendedKeyUsage = serverAuth, clientAuth
  subjectAltName = @alt_names
  [req]
  req_extensions = req_ext
  [req_distinguished_name]
  commonName_default = localhost
  [req_ext]
  subjectAltName = @alt_names
  [alt_names]
  DNS.1 = *.localhost
  DNS.2 = foo.localhost
  DNS.3 = localhost
  </code></pre>
  <p>Then I sign.</p>
  <pre><code>openssl x509 -req \
      -in priv/cert/localhost.csr \
      -extfile priv/cert/localhost.ext \
      -CA priv/cert/ca.crt \
      -CAkey priv/cert/ca.key \
      -CAcreateserial \
      -out priv/cert/localhost.crt \
      -days 365 \
      -sha256
  </code></pre>
  <p>After trusting my crt and navigate locally to say localhost or foo.localhost I get all green but if I go to say bar.localhost the wild card does not work and I get a NET::ERR_CERT_COMMON_NAME_INVALID on chrome.</p>
  <p>what am I missing here. I've addressed the Subject Alternative Name, I've ruled out that SAN via foo works. Common name does not even matter anymore from what I read. I'm at a loss.</p>