ERR_INSECURE_RESPONSE + subdomains - google-chrome

Question

I need help to understand if Chrome behaviour is OK or it's due to my mistake. I'm using selfsigned-certificates and subdomains.
From https://preproduser.svtools.tp.XXX.it/#!/login/ there is an Ajax query to another subdomain which returns error:
OPTIONS https://preprodauth.svtools.tp.XXX.it/v1/authenticate net::ERR_INSECURE_RESPONSE
Both app are served by a Nging reverse proxy with this certificate:
# openssl x509 -noout -certopt no_sigdump,no_pubkey -text -in selfsigned.svtools.tp.XXX.it.crt
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 15659850292680964857 (0xd952f6df2b0bbaf9)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=IT, ST=Italia, L=YYY, O=XXX, CN=*.svtools.tp.XXX.it
Validity
Not Before: Apr 2 18:36:50 2017 GMT
Not After : Mar 31 18:36:50 2027 GMT
Subject: C=IT, ST=Italia, L=YYY, O=XXX, CN=*.svtools.tp.XXX.it
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment
X509v3 Subject Alternative Name:
DNS:svtools.tp.XXX.it, DNS:preproduser.svtools.tp.XXX.it, DNS:preprodauth.svtools.tp.XXX.it
I see on Chrome that the certificate has SAN and Chrome tells me ERR_CERT_AUTHORITY_INVALID (expected behavior).
Question: after accepting the security certificate issue before opening https://preproduser.svtools.tp.XXX.it/ I expect no further problems for https://preprodauth.svtools.tp.XXX.it/. Chrome still complains the security issue. Can I avoid this?
Riccardo

Answer 1

While you can override the warning about ERR_CERT_AUTHORITY_INVALID it will only override the warning for exactly this certificate at exactly this hostname and not automatically trust this certificate for any other hosts.
Just imagine that this would be otherwise: in this case some man in the middle attacker could use a certificate to intercept the connection to some unimportant host where many would just override the warning because there are no sensitive data. Once this is done the attacker could use the same certificate (now trusted by the browser) to intercept connections to important hosts. That's why any certificate exemption is only for the specific hostname where the certificate was explicitly exempted for.