SEC_ERROR_REUSED_ISSUER_AND_SERIAL error from Firefox

Question

I have a test environment where I frequently deploy VMs for testing purposes. When trying to access the web interface of such a VM with an IP that had already been used before I'm getting a certificate error from Firefox

SEC_ERROR_REUSED_ISSUER_AND_SERIAL

which cannot be bypassed.

A quick web search yielded the recommendation to delete the certificate and CA from the Firefox certificate store. However, I cannot find the (private) CA certificate in the authorities list, and deleting just the server certificate does not resolve the issue.

Answer 1

I'm not quite sure why Firefox won't display the CA certificate in the GUI, but you can manually remove it from the file cert9.db in your Firefox profile.

sqlite3 cert9.db "DELETE FROM nssPublic WHERE printf('%s',a3)=='LABEL'"

Replace LABEL with the correct value for the certificate you want to remove (usually the subject of the certificate).

The printf() function is needed because the data is stored as BLOBs and must be converted to a string before it can be compared to the reference string.

If you're uncertain about what label to specify you can list all labels like this:

sqlite3 cert9.db "SELECT a3 FROM nssPublic"