SSL Decryption Fails: sec_error_reused_issuer_and_serial

[mhuels]

In the newest PA-OS 3.1.2 seems to be a problem with the Proxy-Certificate.

If browsing with Firefox, you get "Errocode: sec_error_reused_issuer_and_serial" on all HTTPS-Sites, if you have implented the proxy certificate in the certificat store (and if not, you can surf without problems after click on "ignore security warning"). With Opera, SSL-Connections fails with a "white window", whether you have installed the proxy certificate in the browser certificate store or not.

[tabner · Accepted solution]

Please open a case with Support.

[mhuels]

We did so some days before. But till now, we got no answer.

[nrice]

I believe your SE opened a case regarding this issue yesterday.  He has been working with Support so you may want to get in touch with him.

[mhuels]

Yes, our SE started a support case. Unfortunenately, we got no solution but only a workaround, which did not work. PA recommended to reimport the PA Certificate through the Firefox security warning dialogue. Otherwise we have to wait on version 3.1.3, which "maybe" helps.

[nrice]

A procedrue for exporting/importing the certificate from/to Firefox can be found at the following link.  It did work in our lab.

(outdated link removed)

[mhuels]

This workaround does not works in our environment.

First we dont see a certificate hierarchy in the firefox but only the solitary certificate from the HTTPs Server.

Second we cannot import the server key as a CA key. Firefox says: "this is not a certificate from a certificate authority ...". Please have a look at the gif-attachement.

I assume, we have another problem with our certificate. We tried first to generate the certificate with the appliance software, just now we use an imported certificate, build with openssl.

Our two 2050 appliances works in a high availability mode.