1680486 - impossible to clear SEC_ERROR_REUSED_ISSUER_AND_SERIAL from the cert db

Status: RESOLVED INCOMPLETE

(Core :: Security: PSM, defect)

Description

[Evgeni Golov]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0

Steps to reproduce:

I have a set of test systems, that get re-reployed every now and then, but retain their name. Inside is an application which self-signs its certificates. After a re-deployment, I can't access the interface of the app anymore, as Firefox refuses to connect:

Secure Connection Failed

An error occurred during a connection to centos7-foreman-2-3.yatsu.example.com. You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.

Error code: SEC_ERROR_REUSED_ISSUER_AND_SERIAL

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

The documentation (https://support.mozilla.org/en-US/kb/Certificate-contains-the-same-serial-number-as-another-certificate) says to go and delete the stored Server and Authority certs, and retry, but that doesn't help.

Workaround: delete the whole ~/.mozilla/firefox/<profile>/cert9.db file.

This is probably related to #435013 which I can't comment on, and #480133 which is "closed - incomplete".

Actual results:

1. deleted the offending Server cert
2. there was no Authority cert to delete
3. visited page → SEC_ERROR_REUSED_ISSUER_AND_SERIAL

Expected results:

visit of page works after deleting the old Server cert

Comment 1

[BugBot [:suhaib / :marco]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Dana Keeler (she/her) [:keeler]]

Does it work if you restart the browser after deleting the certificates?

Comment 3

[Evgeni Golov]

I think it does not, but I'll reproduce the issue later and report back!

Comment 4

[Evgeni Golov]

Yepp, just reproduced it. Doesn't help.

What does work is sqlite3 ~/.mozilla/firefox/<profile>/cert9.db and then doing a delete from nssPublic where id=320153485 (well, whatever ID that cert got, because it's still there).

Interestingly, Firefox won't start properly after that sqlite command anymore, and requires a few kills until it realizes it can't restore my session, wipes it, and then it starts and I can access the app again.

Comment 5

[Johann Hofmann [:johannh]]

Dana this feels more like PSM to me but feel free to move back if you disagree :)

Comment 6

[Dana Keeler (she/her) [:keeler]]

How about if you clear the network cache as well?
Unfortunately, the assumption that no two certificates will have the same issuer and serial number and yet have different contents was baked into the core of NSS (Firefox's security library) more than 20 years ago, so you'll probably have more luck solving this problem if you change the system you're using to always generate unique certificates (e.g. randomize the serial numbers). I know that's not a satisfactory answer, but from what I know of NSS, it's a realistic one.

Comment 7

[Evgeni Golov]

I am kinda sure I tried clearing the cache in the past too, but I'll make sure to explicitly test that.

While I agree I can (probably) change my app to generate properly distinguishable CAs on each run, I don't think this is something a random user can do (especially if we look at other SEC_ERROR_REUSED_ISSUER_AND_SERIAL bugs filed here and how they end up hitting on some wifi/router appliance the user usually has no control over).

Even more so if there is explicit documentation how this behaviour can be fixed, and that doc doesn't seem to work properly, but given it is documented, I'd assume it did work at some point?

I (as a user) don't expect NSS to accept a reused issuer/serial while it still knows the old cert, but once I have flushed the old cert from the cert db, it should not be "reused" anymore, the old cert is gone.