topic SSL Decryption Fails: sec_error_reused_issuer_and_serial in General Topics

SSL Decryption Fails: sec_error_reused_issuer_and_serial

mhuels — Wed, 02 Jun 2010 10:54:42 GMT

In the newest PA-OS 3.1.2 seems to be a problem with the Proxy-Certificate.

If browsing with Firefox, you get "Errocode: sec_error_reused_issuer_and_serial" on all HTTPS-Sites, if you have implented the proxy certificate in the certificat store (and if not, you can surf without problems after click on "ignore security warning"). With Opera, SSL-Connections fails with a "white window", whether you have installed the proxy certificate in the browser certificate store or not.

Re: SSL Decryption Fails: sec_error_reused_issuer_and_serial

tabner — Wed, 02 Jun 2010 11:13:55 GMT

Please open a case with Support.

Re: SSL Decryption Fails: sec_error_reused_issuer_and_serial

mhuels — Wed, 02 Jun 2010 16:19:31 GMT

We did so some days before. But till now, we got no answer.

Re: SSL Decryption Fails: sec_error_reused_issuer_and_serial

nrice — Wed, 02 Jun 2010 20:27:20 GMT

I believe your SE opened a case regarding this issue yesterday. He has been working with Support so you may want to get in touch with him.

Re: SSL Decryption Fails: sec_error_reused_issuer_and_serial

mhuels — Fri, 04 Jun 2010 10:00:09 GMT

Yes, our SE started a support case. Unfortunenately, we got no solution but only a workaround, which did not work. PA recommended to reimport the PA Certificate through the Firefox security warning dialogue. Otherwise we have to wait on version 3.1.3, which "maybe" helps.

Re: SSL Decryption Fails: sec_error_reused_issuer_and_serial

nrice — Fri, 04 Jun 2010 23:11:14 GMT

A procedrue for exporting/importing the certificate from/to Firefox can be found at the following link. It did work in our lab.

(outdated link removed)

Re: SSL Decryption Fails: sec_error_reused_issuer_and_serial

mhuels — Mon, 07 Jun 2010 16:16:52 GMT

This workaround does not works in our environment.

First we dont see a certificate hierarchy in the firefox but only the solitary certificate from the HTTPs Server.

Second we cannot import the server key as a CA key. Firefox says: "this is not a certificate from a certificate authority ...". Please have a look at the gif-attachement.

I assume, we have another problem with our certificate. We tried first to generate the certificate with the appliance software, just now we use an imported certificate, build with openssl.

Our two 2050 appliances works in a high availability mode.