topic Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial" in General Topics

SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

ITSama — Thu, 24 Apr 2014 05:42:54 GMT

After turning on the SSL-Decryption, firefox tells me every moring after restart this error "sec_error_reused_issuer_and_serial", after deleleting the whole history and a restart of firefox it works, but that workaround every morning couldn't be the solution.

Anybody some suggestions??

thx

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

Hithead — Thu, 24 Apr 2014 07:54:58 GMT

Hi,

when you get this message? when open any https websites or open the PA-WebGui?

if you get it with any https websites, please check the Trusted and Untrusted Certificates. Take a look:

The Certificates are generated all from PA.

gateway.example.com = DNS entry with the IP of your internet breakout at your PA

pa-webgui.example.com = DNS entry with the IP of your MGT from your PA

Export the RootCA certificate and import it in your firefox. And if you having more PAs with the same RootCA and WebGui certificates generated from you will always get the problem with FF when opening the WebGui. Try Chrome or IE.

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

ITSama — Thu, 24 Apr 2014 11:06:21 GMT

Hi Hithead,

i had only one certificate for all purposes signed as a Subordinate-CA from my Organisation-CA??? IE has no problems with that, only FF.

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

Hithead — Thu, 24 Apr 2014 11:46:34 GMT

hi,

FF has a problem with it. FF call it a "security feature" and IE ignore the usage of the same CA on different sites. Difficult to explain.

But by the way: Do not use a trusted certificate with the option "forward trusted certificate". If a page is recognized as untrusted by the PA, the user will not be promoted with a certificate error. It will trust it. Generate a new certificate with PA, with the same values but do not choose an issuer (signed by) and select the usage "untrusted Certificate" for it.

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

ITSama — Thu, 24 Apr 2014 12:22:29 GMT

"Do not use a trusted certificate with the option "forward trusted certificate".

Sorry I didn't really understand.

You mean "Do not use a trusted certificate with the option "forward untrusted certificate"?

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

Hithead — Thu, 24 Apr 2014 12:40:18 GMT

oh, you are right 😃

I mean untrusted

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

ITSama — Thu, 24 Apr 2014 14:02:55 GMT

Okay :smileygrin:. I have tested it and it looks good with the untrusted certificates.

And for the "security feature" in FF, i will look for a workaround .

But I have one more question: Do you mean it's useful to work with OCSP-Responder or CRL-Lists? Any Ideas or best practice, because there are different meanings about that?

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

Hithead — Fri, 25 Apr 2014 08:16:58 GMT

we don't activated that, because of a bug. But we will enable it soon again (with 6.0.2). Only crl . After enable it, you have to check the system logs, if your PA can download the crl .

BTW: read this https://live.paloaltonetworks.com/thread/8984

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

gafrol — Fri, 25 Apr 2014 08:31:24 GMT

This has been fixed in 6.0.2 which has been released yesterday.

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

ITSama — Mon, 28 Apr 2014 08:49:49 GMT

hi again,

okay i will test the OCSP with the new PAN-OS Version soon, but now I have another problem with the selfsigned certificate for the untrusted Certificates, because I get many certificate errors because the most intermediate CA's are not in the default trusted certificate list on the PA.

So what is the best way to solve the problem. It seems to be a little bit difficult to import all possible certificates for the Sub-CA's??

Re: SSL Decryption - Firefox error: "sec_error_reused_issuer_and_serial"

Hithead — Fri, 09 May 2014 13:53:53 GMT

hi,

check your system and traffic logs (traffic logs from your MGT IP of PA). may you will find the some information what cannot be downloaded. Allow your PA to download the resources.