# Certificate Issue: Same serial number as another certificate **URL:** \ **Category:** General\ **Created:** [February 14, 2019, 8:45pm UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338 "2019-02-14T20:45:55Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![emcclure](https://avatars.discourse-cdn.com/v4/letter/e/c37758/32.png) [@emcclure](https://forums.suse.com/u/emcclure)\ **Post date:** [February 14, 2019, 8:45pm UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/1 "2019-02-14T20:45:55Z")
Hello, I’m using Rancher v2.1.6 for 2 different HA setups. Both are using the NGINX load balancer. Both have a DNS name in our system in the same domain. They are in different subnets, vlans, hosts and VM’s being setup. The first one I was able to access fine until today. All of a sudden I get this error: You have received an invalid certificate. Please contact the server administrator or email correspondent and give them the following information: Your certificate contains the same serial number as another certificate issued by the certificate authority. Please get a new certificate containing a unique serial number. Error code: SEC\_ERROR\_REUSED\_ISSUER\_AND\_SERIAL ``` The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. Please contact the website owners to inform them of this problem. ``` I’ve tried deleting files from Firefox for this, but it doesn’t make a difference. Tried this on another machine as well that had never accessed the Rancher sites I created and I still get the same issue. How do I fix this? I plan on building this several times, sometimes with rke, sometimes without, but I may wind up installing Rancher afterwards, so I don’t want these kinds of problems to persist if we keep building more and more Rancher clusters. I’m not sure if there’s some particular cert thing I’m supposed to do, but I basically went thru the HA steps on the Rancher page to make this work. Any help is appreciated. ---
**Author:** ![emcclure](https://avatars.discourse-cdn.com/v4/letter/e/c37758/32.png) [@emcclure](https://forums.suse.com/u/emcclure)\ **Post date:** [February 14, 2019, 9:10pm UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/2 "2019-02-14T21:10:57Z")
I can get this to work in IE (Well not really it doesn’t load the site), Edge and Chrome, but not Firefox. In IE I just added the certs for the site and for cattle-ca into the Trusted Root and it’s working for Edge and Chrome, but still failing in Firefox. ---
**Author:** ![warmfusion](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/warmfusion/32/5520_2.png) [@warmfusion](https://forums.suse.com/u/warmfusion)\ **Post date:** [April 9, 2019, 11:20am UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/3 "2019-04-09T11:20:12Z")
I’ve seen a similar issue on MacOS Firefox, the fix for me was to `rm ~/Library/Application\ Support/Firefox/Profiles/*/cert*.db` and restart firefox. The underlying cause suggests the RKE self-signed cert isn’t generating unique serials+issuer combinations, so across two different deployments there is a common serial number for a cert used on two different sites. This isn’t allowed apparently. I’d assume the fix is to generate unique serial numbers when creating the self-signed cert for a given domain installation during bootstrap processes, or once the cluster is started rotate the certificates to a new instance with a new serial. ---
**Author:** ![vincent](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/vincent/32/7156_2.png) [@vincent](https://forums.suse.com/u/vincent)\ **Post date:** [April 10, 2019, 12:44am UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/4 "2019-04-10T00:44:28Z")
This comes from the kubernetes code used to generate the cert. [https://github.com/rancher/rancher/issues/19488](https://github.com/rancher/rancher/issues/19488) ---
**Author:** ![melsayed](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@melsayed](https://forums.suse.com/u/melsayed)\ **Post date:** [July 31, 2019, 6:54pm UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/5 "2019-07-31T18:54:35Z")
I am trying to reproduce this issue. Can you guys provide more information about your HA setup: - What rancher server version are you using? - Which SSL configuration did you use? How did you generate the certificates ? - How are you doing the loadbalancing ? ---
**Author:** ![emcclure](https://avatars.discourse-cdn.com/v4/letter/e/c37758/32.png) [@emcclure](https://forums.suse.com/u/emcclure)\ **Post date:** [August 5, 2019, 4:07pm UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/6 "2019-08-05T16:07:34Z")
Hi @melsayed, Most of the info should be in my original statement. I used Rancher v2.1.6, have the NGINX load balancer and used self signed certs. ---
**Author:** ![warmfusion](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/warmfusion/32/5520_2.png) [@warmfusion](https://forums.suse.com/u/warmfusion)\ **Post date:** [August 22, 2019, 4:27pm UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/7 "2019-08-22T16:27:49Z")
Its actually pretty easy to reproduce; 1. Setup a rancher cluster 2. Setup another rancher cluster on a different url 3. Browse to (1) and accept the certs, then browse to (2) I’ve seen this issue when i’ve simply been trying to use my homelab cluster at [rancher.mydomain.com](http://rancher.mydomain.com) and then using [rancher.mycompanydomain.com](http://rancher.mycompanydomain.com) fails (and vice versa). The only fix is temporary where I remove the SSL cache from my browser, or use different browsers for different sites. ---
**Author:** ![lyra](https://avatars.discourse-cdn.com/v4/letter/l/b9bd4f/32.png) [@lyra](https://forums.suse.com/u/lyra)\ **Post date:** [August 13, 2024, 8:00am UTC](https://forums.suse.com/t/certificate-issue-same-serial-number-as-another-certificate/13338/8 "2024-08-13T08:00:50Z")
The `SEC_ERROR_REUSED_ISSUER_AND_SERIAL` error typically occurs when the same SSL certificate issuer and serial number are being reused, causing conflicts. To resolve the error in your Rancher v2.1.6 HA setups, **follow these steps:-** 1. **Generate Unique Certificates** 2. **Update NGINX Configuration** : 3. **Clear Browser and System Cache** 4. **Verify Certificate Deployment** : 5. **Restart Services** : 6. **Check for Certificate Conflicts** : Following these steps should help resolve the [SEC\_ERROR\_REUSED\_ISSUER\_AND\_SERIAL error](https://cheapsslweb.com/blog/how-to-fix-sec-error-reused-issuer-and-serial-error-firefox/) in the certificate issue and prevent similar problems in future deployments.