I have an application that hosts multiple RESTful APIs. When the application is installed, it automatically generates a self-signed certificate authority cert and then each API gets its own certificate signed by that authority.

When I want to configure another computer to access those APIs, I need to load that CA into the local computer certificate store on that new client computer, then certificate validation should be successful for each API service. Most of the time this works fine, but around 25% of the time validation still fails and I can never figure out why.

In today’s instance, I have loaded the CA cert into Windows’ Local Computer Trusted Root Certification Authorities store, and if I open the URL in Firefox it works fine, but when I open it in Chrome I get the NET::ERR_CERT_AUTHORITY_INVALID error in the browser, and in the debug window it shows ERROR: No matching issuer found.

What could be causing Chrome to not recognize the signing authority cert that is loaded into the Windows Local Computer store and is recognized by Firefox?

I’ve verified I can see the CA cert in the Windows Local Computer store. I can see it works fine with Firefox with no other configuration. I don’t know how to trace Chrome’s certificate validation to tell where it’s going wrong.