how to change ssl certificate serial number

Question

I upgraded the linux full release on a server. As part of the process I generated a new local ssl certificate key set with genkey. However the serial number remained the same and client apps such as thunderbird are erroring with: "Your certificate contains the same serial number as another certificate issued by the certificate authority. Please get a new certificate containing a unique serial number".

I see I have three choices:

1. copy the old cert from the original OS system.
2. regenerate a second new cert with a new serial number
3. remove the keys from the apps and allow the new one to

This is a limited server environment with only 4 client users. A couple of follow up questions:

I prefer solution 3. Is there a way to scan cert.db for serial number? Is there a cert.db tool? The tool in Mozilla does not report serial number and the duplicate certificates are not obvious.

The second choice is the generate a new serial number for the server. How is this done? Are local certs verified externally and will this create an issue.

Answer 1

This is beginning to look like a thunderbird issue. I created a new thunderbird account for the same user id / pw as a new 'user'. This access was successful. I am thinking of copying the cert8.db from the new user to thunderbird. I am not sure unintended consequences this would cause.

Answer 2

I proceeded to copy the cert8.db from a new user over the original cert8.db. Thunderbird is now able to access e-mail from the imap server using starttls. I have not tried ssl/tls.

The original cert8.db was very old, it had been copied from system to system since the very early origin of mozilla mail. It was over 800kb. The new cert8.db is 60kb.

There did not appear to be an easily usable cert8.db editor viewer. There does not appear to be a way to view certificates from within Thunderbird. During the 'exception' process the certificate is view able. However once it is accepted it is not.

Dan