Project

General

Profile

Actions
Copy link

Bug #11514

closed

Renewing a self-signed CA or certificate does not update the serial number

Added by Jim Pingle about 3 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jim Pingle
Category:
Certificates
Target version:
2.5.1
Start date:
02/23/2021
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
2.5.0
Affected Architecture:

Description

When renewing a self-signed CA entry or self-signed certificate in the GUI the serial number is not replaced with a new one. The main example of this is the automatic GUI cert, which has a serial of 0 before and 0 after renewal.

Since the serial is not replaced, some clients such as Firefox reject the cert change if the old one was stored (e.g. SEC_ERROR_REUSED_ISSUER_AND_SERIAL error).

Since it's self-signed the serial can be randomized safely.

The serial is replaced as expected when renewing a regular certificate.

Actions
Copy link
 #1

Updated by Jim Pingle about 3 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100
Actions
Copy link
 #2

Updated by Jim Pingle about 3 years ago

  • Description updated (diff)
Actions
Copy link
 #3

Updated by Danilo Zrenjanin about 3 years ago

  • Status changed from Feedback to Resolved

Tested on the latest release.

Renewed certificate got a new serial number. It works as expected. Ticket resolved.

Actions
Copy link
 #4

Updated by Jim Pingle about 3 years ago

  • Target version changed from CE-Next to 2.5.1
Actions
Copy link
 #5

Updated by Renato Botelho about 3 years ago

  • Status changed from Resolved to Feedback

Needed to be tested on 2.5.1-RC

Actions
Copy link
 #6

Updated by Jim Pingle about 3 years ago

To test, on 2.5.0 or 21.02-p1:

  • Generate a fresh self-signed GUI cert at an SSH or console shell prompt: pfSsh.php playback generateguicert
  • Access the GUI from Firefox, accept the self-signed certificate
  • Navigate to System > Cert Manager, Certificates tab
  • Renew the GUI certificate, note that the serial is 0 (or may not be printed at all) and is still 0 after renewal.
  • Attempt to access another page in the GUI, and Firefox will reject the certificate as mentioned in the description above.

Repeat the test on a snapshot with the fix and the serial should be randomized and different before/after renewal, and it will not be rejected by Firefox.

Actions
Copy link
 #7

Updated by Jim Pingle about 3 years ago

  • Subject changed from Renewing a self-signed CA or self-signed certificate does not update the serial to Renewing a self-signed CA or certificate does not update the serial number

Updating subject for release notes.

Actions
Copy link
 #8

Updated by Jim Pingle about 3 years ago

  • Status changed from Feedback to Closed
Actions
Copy link

Also available in: Atom PDF