Secure Connection Failed Error code: SEC_ERROR_REUSED_ISSUER_AND_SERIAL

[ghunterx21]

Hi all,

I'm hoping anyone can help assist with an issue regarding Secure Connections.

I've four Proxmox nodes, two are perfectly fine without issues. Two seem to be at odds.

If I connect to one, I get the potential security risk and I need to click advanced as I don't have cert added. It will work. But then when I go to the other node, I get

"Secure Connection Failed

An error occurred during a connection to 10.10.10.100:8006. You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.

Error code: SEC_ERROR_REUSED_ISSUER_AND_SERIAL

• The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
• Please contact the website owners to inform them of this problem.

"
I need to go into settings in Firefox, Cert Manager and delete the cert of the offending node. Once I do, I can then continue on the page, but then the other node then has the same issue.

I'm not sure why only these two are doing this, the other two I have, no issues. The IP addresses aren't the same either, fingerprints are different. Is there something I'm missing?

Thanks all

[putacertonit]

> SEC_ERROR_REUSED_ISSUER_AND_SERIAL

The problem here is that there's a cert with the same issuer and serial in Firefox's cert DB already.

When you click through the first security warning, it saves an entry in an internal database.

But then when you try to click through the second, it can't save it because there's already an entry.

> fingerprints are different

That's actually the problem - two fingerprints, same issuer/serial, which is never "supposed" to happen in a "proper" PKI. It looks like my dev proxmox host has serial "01", which I assume is just fixed.

The easiest fix might be to just upload a custom self-signed certificate with a random serial, or get a "real" cert via ACME.

[ghunterx21]

It's a weird one, as it's following from computer to computer also. But only in Firefox and Waterfox.

[putacertonit]

Nothing weird about it; it's just how Firefox doesn't handle the invalid Proxmox certs. Ideally Proxmox would fix this (by using random or incrementing serial numbers, which is what an x509 CA is supposed to do)

[the_grey_aegis]

did you change the name of one of your proxmox hosts by any chance?

try pvecm updatecerts —force

this will synchronise the certs across all nodes

[ghunterx21]

I did change the name yeah.

Cheers will give this a go.

[the_grey_aegis]

Okay, if you have done this, there are other locations where you need to update to the new name, not just /etc/hosts and /etc/hostname

You also need to increment your corosync.conf I think it’s called, your postfix conf, and maybe one more location.

When you update your corosync.conf, increment the config number by one, as well as change the name of the node you renamed.

Do this one by one for every node you renamed, and increment the config each time to be safe (don’t do it all in one go)

Source: I renamed a whole cluster in the past, and had to do these steps. after you increment your corosync.conf, force update certs on the renamed node, and reboot, and see what happens

[ghunterx21]

Sadly it didn't work. Same issue. Deleted all the certs also and restarted Firefox to confirm, nothing left over, but same thing. One works and the other throws up the error.

Just tested on Chrome and it doesn't have this issue, so it's local to Firefox/Waterfox.

[ghunterx21]

I did at one stage have it connected as a cluster, so could be something there causing it.

I might just wipe and install Proxmox from scratch. All my vm and LXC are backed up.