Chrome ERR_CERT_VALIDITY_TOO_LONG error

Chrome refuses to access the resource with `NET::ERR_CERT_VALIDITY_TOO_LONG`.
I can add an exception by using `--unsafely-treat-insecure-origin-as-secure` and clicking the "Advanced" > "Proceed to ." button on the warning page. Chrome still will show "Not secure" in the address bar.

It would be nice to have this working 100%, not just 90% :)

The cert I just generated has a validity range of exactly 10 years:

**Not valid before:** Wednesday, 13. January 2021 at 12:45:06 Central European Standard Time
**Not valid after:** Monday, 13. January 2031 at 12:45:06 Central European Standard Time

_Note: Chrome displays not only the cert, but also the rootCA in their error page._

Below you can find an example I just generated (the second cert is the `rootCA.pem` file contents):

~~_Note: I have no idea if this is a bug/ regression where I can't find a way to debug and find it's root cause, or Chrome just updated in the background and this is expected default behavior._~~

```
Your connection is not private
Attackers might be trying to steal your information from traefik.bell.test (for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_VALIDITY_TOO_LONG
Subject: mkcert development certificate

Issuer: mkcert root@devcerts

Expires on: Jan 13, 2031

Current date: Jan 13, 2021

PEM encoded chain:
-----BEGIN CERTIFICATE-----
MIIEQDCCAqigAwIBAgIQEtGKwB/F07dtGmZ3flpA0jANBgkqhkiG9w0BAQsFADBX
MR4wHAYDVQQKExVta2NlcnQgZGV2ZWxvcG1lbnQgQ0ExFjAUBgNVBAsMDXJvb3RA
ZGV2Y2VydHMxHTAbBgNVBAMMFG1rY2VydCByb290QGRldmNlcnRzMB4XDTIxMDEx
MzExNDUwNloXDTMxMDExMzExNDUwNlowQTEnMCUGA1UEChMebWtjZXJ0IGRldmVs
b3BtZW50IGNlcnRpZmljYXRlMRYwFAYDVQQLDA1yb290QGRldmNlcnRzMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsAnLQORBXCzVQLdAy6NsvSYM7Kfx
+GWJbTvHJz+QzwbFo6yXlcjpCTLAz0a6djR/pyFbXeAzfGsPfdgneWAzFWKaVgGN
ES6mGc1ul/BhxmUVPVbSJSiZviPXCd6uWJYcXS0zUNEYhGOB+ve8YdvfYu5PNr8A
qPwqhm/n++559OXTSHFyR6SfygMal8Seulm3aw4XnXhElWT42qsj0UjGY5Mnl02h
TZeDI3NAVuvPcqbJwI02rA9cs+N/HETqxDT1sJvCW7dW2gYjd58L/Iz4XoXPipkJ
JoEHZoSJ9VwFz6S9TJc+TtDwtkFk6e2PRpdaUQVNcCMFYkADFCGjDKopowIDAQAB
o4GdMIGaMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNV
HRMBAf8EAjAAMB8GA1UdIwQYMBaAFFIiavM5rChO0XwYvbaBcqjf4EXfMEQGA1Ud
EQQ9MDuCCyouYmVsbC50ZXN0ggliZWxsLnRlc3SCCWxvY2FsaG9zdIcEfwAAAYcQ
AAAAAAAAAAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAYEAPazkSSYItR239Dh8
8y02wRUSeqsOLI07susbIAWKFXd37SZF3NU4+v4NJwSX9SRGNDD1i3wwC+SaC9Rg
ty4hX4JEiUmiKeZPsD4tNgsPFPekEi/bmb5pSgbROtHTcAe3QfVuRjsKKtta5c5G
ST17LtQdajJ8Zc88pfrsxwrUnpBx3xgIlKJKQqtBvmxTGJA+11vbT9c8OfQ9PoK4
PxzhMskKRY6DWm5BkFd/x/kLdofSvDHMKa3k4zP2uiiTMgu42FforRTmo3odCK/b
40HQQ2Vyg4H5fKeO06RMDwk4rB57gWM4TB2VLwwF870y9BBPvYb5Rer+y418b20b
hfAOVtDbJWvxxKWhk1AFheFvFzUFFak4wkXPl/VBPRI+0mZVfqoiFLdQbTh5qoqz
j7Vz0t6wMzLePcpnixWQCb8x0bJIRkqIhG1VY5MFUruGFLAjmjUssgIS3NP95/Gw
IL+zhJSTFQ7sXzWdqwGjbpccClqJLGAmwvkN03eGqjlOkvgX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEfjCCAuagAwIBAgIRAMM6NYCUwrVxff+UzfRfI70wDQYJKoZIhvcNAQELBQAw
VzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMRYwFAYDVQQLDA1yb290
QGRldmNlcnRzMR0wGwYDVQQDDBRta2NlcnQgcm9vdEBkZXZjZXJ0czAeFw0yMTAx
MTMwMDQzMjZaFw0zMTAxMTMwMDQzMjZaMFcxHjAcBgNVBAoTFW1rY2VydCBkZXZl
bG9wbWVudCBDQTEWMBQGA1UECwwNcm9vdEBkZXZjZXJ0czEdMBsGA1UEAwwUbWtj
ZXJ0IHJvb3RAZGV2Y2VydHMwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIB
gQDlThmign5Fwnhswp0ZYv7HFHrr8aFnDtmF+pJKcfetAlxAQwGQRaF8JLynDs+K
tZ8jQjQtEbsUVAvz4oc7r+RM4g5jncpk7lYRIyetnUs4BiOdnVcwo1vQ7Q5n64nT
QB/FXSvYjywYIKL0COft+bBtToD4fsVz1OYYON2x2jGcpyAhJ8L3p7VVRQlN4JQn
kJoVRjQKdgTygwj3AIoY8XS9Sw+BQtvS5Mbaq9QJkbt7v8eB7xt0l51mCEYMg1ee
KuBtlHAKafT5vtNpAmdk2qc+uRhUhG4SLGoqwfUyj7LCBu9pVt46WUur0Mo+m7qB
3r9aTqRqEU0qdmh5VO2j5iPGQj/pVoIEpWEJ00aL6NkJzHcJfL/VpfZKQhbVUAw4
ut3Mo/IP00rNaqYcuk/EwSnbt+azNOgdrP77kIZCqH119yxcril9I7LpftpoJkhE
Nwc0WiTQB5yObfqTgGNOrg1YoEty5Rg8OU4DG3459JFbqsRoZgMwsIiw05tUZ493
B2ECAwEAAaNFMEMwDgYDVR0PAQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAw
HQYDVR0OBBYEFFIiavM5rChO0XwYvbaBcqjf4EXfMA0GCSqGSIb3DQEBCwUAA4IB
gQB/RohLFOG2UBUXfaRKTZoLL4RqbBkgmqQ18DoKHupuTBtppiPYYfunXK4e+Kze
YAx7H6wNIHw813ZzwlRkkcpW9zy/m+SrAzt+KCSUJwhCOBET5PAURplnra3KRY0y
tXE5KyQ9ixaLsE5/W1PYkSZ8VxSbwyxC+cZga+621Yx4g0bSjcGE43khfKPrNCjG
VZ1VqRQScJJ6qiFps3EbnOR9BrPoCLRqDbZEEESRGk+Gq7WEt3UVNolBEvJL8NNE
T2Zd27FXxx7dEaqO3YGmnIUfR2sQ1pFgxz8pPjWHAAigEKYFoGcxzUvVHWA7QNi8
QeTKrjxEX92s9LhcoUXie7GcuD4Zm6VSt4/2KR/4peK6fgGAasU34wEnqIc2y2qV
+0Cog7lHDjYdYC0qj2e8haYBe94STPYv9DMxbtq1XxDB0tJbqA1Aj0hABky1/RY5
eTOLw5lhpNOSe38xWUSHQUI86clHS2Es2mpyLRCKLzo2RTTWAjynS3oH5TX/QwVI
tEw=
-----END CERTIFICATE-----
```

The fingerprints are correct and matching. Here're the scripts to check.

```shell
#!/usr/bin/env bash
CERTIFICATE=${*?Certificate missing}
openssl x509 -noout -in "${CERTIFICATE}" -fingerprint -sha1
```

```shell
#!/usr/bin/env bash
CERTIFICATE=${*?Certificate missing}
keytool -printcert -v -file "${CERTIFICATE}"
```

#### Setup
The whole test/ demo setup contains out of Alpine Linux containers. The containers are orchestrated using Docker Compose. All public facing containers share the same network and a named volume:

```yaml
---
# $ROOT_DOMAIN and $MKCERT_TAG are set inside `.env`
version: '3'

services:
# Local development certificates (mkcert)
devcerts:
image: "kklepper/mkcert_a:${MKCERT_TAG:-alpine}"
hostname: "devcerts"
command:
- /bin/sh
- -c
- "/root/mkcert -cert-file $${CAROOT}/cert.$${CERT_FILENAME} -key-file $${CAROOT}/key.$${CERT_FILENAME} '*.${ROOT_DOMAIN}' ${ROOT_DOMAIN} localhost 127.0.0.1 ::1"
networks:
- certs
ports:
- "2443:443"
working_dir: /usr/local/share/ca-certificates
volumes:
- type: volume
source: dev-cert-storage
target: /usr/local/share/ca-certificates
volume:
nocopy: false
environment:
- CAROOT=/usr/local/share/ca-certificates

other_container:
volumes:
# Certificates for local development.
- dev-cert-storage:/usr/local/share/ca-certificates:ro

volumes:
dev-cert-storage:
driver_opts:
type: none
o: bind
device: ${PWD}/certs
```

Process:
1. The container simple receives a `docker-compose up devcerts` and then creates the certs. It saves it to the named volume, which then shared.
1. Then the cert gets copied to the mkcert CA root dir: `cp ./root* "$(mkcert -CAROOT)"`
1. After this happened, the certs get added to the keychain in macOS: `cd ./path/to/certs; mkcert -install`.

```
The local CA is now installed in the system trust store! 👍
The local CA is now installed in the Firefox trust store! 👍
The local CA is now installed in Java's trust store! 👍
```

**Provider:** Docker Compose/ Docker using [The mkcert image by kklepper](https://hub.docker.com/r/kklepper/mkcert_a/tags?page=1&ordering=last_updated).

##### System
**`mkcert`:**
```
$ mkcert --version
v1.4.3
```
**Host OS:** MacOS 11.1 Big Sur
**Google Chrome:** Version 87.0.4280.141 (Official Build) (x86_64)
**Firefox:** 84.0.2 (64-bit)
**Safari:** Version 14.0.2 (16610.3.7.1.9)

Might be related to:
- https://github.com/FiloSottile/mkcert/issues/313

_Note: Verbose process description, keywords, etc. are meant to offer better indexing to help others find this issue and hopefully also find some help._

Start by running the Docker Compose devcerts setup and comparing the generated certificate's validity period with Chrome's requirement. The issue provides no source file or test entry point; identify which mkcert generation path controls that period, then verify that the resulting certificate is accepted by Chrome without an exception.

Written by the indexing model from the issue text.