Renewing a self-signed CA or certificate does not update the serial number
When renewing a self-signed CA entry or self-signed certificate in the GUI the serial number is not replaced with a new one. The main example of this is the automatic GUI cert, which has a serial of
0 before and
0 after renewal.
Since the serial is not replaced, some clients such as Firefox reject the cert change if the old one was stored (e.g.
Since it's self-signed the serial can be randomized safely.
The serial is replaced as expected when renewing a regular certificate.
Updated by Jim Pingle 8 months ago
To test, on 2.5.0 or 21.02-p1:
- Generate a fresh self-signed GUI cert at an SSH or console shell prompt:
pfSsh.php playback generateguicert
- Access the GUI from Firefox, accept the self-signed certificate
- Navigate to System > Cert Manager, Certificates tab
- Renew the GUI certificate, note that the serial is 0 (or may not be printed at all) and is still 0 after renewal.
- Attempt to access another page in the GUI, and Firefox will reject the certificate as mentioned in the description above.
Repeat the test on a snapshot with the fix and the serial should be randomized and different before/after renewal, and it will not be rejected by Firefox.