As part of an internal Client/Server application, I have created my own (self-signed) Certificate Authority (CA), as well as both Client and Server certificates signed by my CA.
Loading my CA certificates into FireFox in PEM format is relatively easy. Creating an HTTPS server in Go using my Server certificates is also (relatively) easy.
However my ultimate goal is to use double ended TLS where both the client and server authenticate each other.
To do this I must load my client certificate/key and my CA's public certificate/key into my browser.
Unfortunately FireFox and Chromium will not load PEM formated client certificates. They will only load client certificate/key bundles in the PKCS#12 format.
Each time I tried, FireFox (v73 on XUbuntu 19:10) refused to load my PKCS#12 by saying that there was a (general) format problem.
I know that my PKCS#12 file is formatted correctly since I am able to use the
openssl pkcs12 -info command to correctly read the contents of my PKCS#12 file.
Both FireFox and Chromium use libnss3 to manage their x509 certificates. After many searches I finally noticed discussion on the web about how to use the
pk12util libnss3-tools to interact with FireFox's
cert9.db certificate database.
Using these two tools to try and load my PKCS#12 file I stumbled upon the "SEC_ERROR_REUSED_ISSUER_AND_SERIAL" error. The
pk12util command provided the additional (helpful) message:
You are attempting to import a cert with the same issuer/serial as an existing cert, but that is not the same cert.
So: What are the sources of “SEC_ERROR_REUSED_ISSUER_AND_SERIAL” errors when using self-signed x509 Certificates in PKCS#12 files?