Guidelines

This site is for tech Q&A. Please keep your posts focused on the subject at hand.

Ask one question at a time. Don't conflate multiple problems into a single question.

Make sure to include all relevant information in your posts. Try to avoid linking to external sites.

Links to documentation are fine, but in addition you should also quote the relevant parts in your posts.

0 votes
433 views
433 views

I have a test environment where I frequently deploy VMs for testing purposes. When trying to access the web interface of such a VM with an IP that had already been used before I'm getting a certificate error from Firefox

SEC_ERROR_REUSED_ISSUER_AND_SERIAL

which cannot be bypassed.

A quick web search yielded the recommendation to delete the certificate and CA from the Firefox certificate store. However, I cannot find the (private) CA certificate in the authorities list, and deleting just the server certificate does not resolve the issue.

in Sysadmin
by (125)
3 20 38
edit history

Please log in or register to answer this question.

1 Answer

0 votes
 

I'm not quite sure why Firefox won't display the CA certificate in the GUI, but you can manually remove it from the file cert9.db in your Firefox profile.

sqlite3 cert9.db "DELETE FROM nssPublic WHERE printf('%s',a3)=='LABEL'"

Replace LABEL with the correct value for the certificate you want to remove (usually the subject of the certificate).

The printf() function is needed because the data is stored as BLOBs and must be converted to a string before it can be compared to the reference string.

If you're uncertain about what label to specify you can list all labels like this:

sqlite3 cert9.db "SELECT a3 FROM nssPublic"
by (125)
3 20 38
edit history
...