1

I've been experimenting a bit with self-issued certificates.

I set up a certificate authority, issued a certificate, and installed it on a webserver. I later deleted that certificate without bothering to revoke it, and decremented the number in the serial.txt file which openssl was using. (There was no good reason to do so, but it seemed a harmless thing to do).

After that, I used the certificate authority to re-issue a new certificate. When I install that certificate on the webserver and access it, Firefox shows me an error:

Your certificate contains the same serial number as another certificate issued by the certificate authority. Please get a new certificate containing a unique serial number. Error code: SEC_ERROR_REUSED_ISSUER_AND_SERIAL

I assume I am getting this error because of the fact that I decremented the serial.txt file, so the newly issued certificate had the same serial number as an older incarnation.

My questions are:

  • How does my browser know this? Does it keep a database somewhere of CA/serial numbers it has seen before?
  • Why does it care? What security risk would be entailed if my browser just ignored the duplicate serial number?
Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424
SauceCode
  • 628
  • 6
  • 16

1 Answers1

3

How does my browser know this?

Firefox seems to cache information about certificates which got used, at least until you restart the browser. If you've added an exception because you are using your own (maybe untrusted) CA then it might even have the information in the CA store.

What security risk would be entailed if my browser just ignored the duplicate serial number?

Revocation information about a certificate issued by a specific CA are checked by serial number only in CRL and OCSP. Thus reusing the same serial number would mean that the same revocation information get applied.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424
  • 1
    Restarting firefox on didn't make the message go away. So I tried going to `about:preferences#advanced` and selecting 'Clear Now' next to 'Cached Web Content' and then restarting firefox. That made the message disappear. And since I deleted the old certificate, I am never going to encounter a duplicate revocation, so there is no security risk in this case. Thank you! – SauceCode Nov 02 '16 at 17:32