Browser errors
SEC_ERROR_REUSED_ISSUER_AND_SERIAL: duplicate serial number
SEC_ERROR_REUSED_ISSUER_AND_SERIALSEC_ERROR_REUSED_ISSUER_AND_SERIAL means Firefox already knows a different certificate with the same issuer and serial number as the one this site presented. That breaks a basic rule of X.509, so Firefox stops. It usually happens when a router, NAS or test server regenerates its self-signed certificate but reuses the same serial number, and Firefox remembers the old one.
Is it the site or your device?
Both are involved: the device produced a non-unique certificate, and your Firefox profile stored the previous one. If the host is public, check it with the SSL checker:
curl ssl.sh/example.com
A publicly trusted certificate should never cause this, because public CAs must use unique, random serial numbers. For devices on your own network, the fix is local and safe.
Causes
1. Device regenerated its self-signed certificate
After a firmware update, factory reset or hostname change, many devices create a new certificate with the same issuer name and a fixed serial (often 0, 1 or 1000). Firefox still has the old certificate stored from an earlier exception. Inspect the serial:
echo | openssl s_client -connect 203.0.113.10:443 2>/dev/null | openssl x509 -noout -serial -issuer -dates
2. Several devices with identical factory certificates
Two units of the same model may ship certificates with the same issuer and serial but different keys. Visiting both triggers the error.
3. Test certificates made with a fixed serial
Scripts that create certificates with -set_serial 1 every time produce duplicates. Each new test certificate then collides with the last.
4. Internal CA with a broken serial counter
A restored CA backup or a reset serial file can reissue serial numbers that were already used.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed" with "Your certificate contains the same serial number as another certificate issued by the certificate authority" and SEC_ERROR_REUSED_ISSUER_AND_SERIAL |
| Chrome / Edge | Usually a normal self-signed warning (NET::ERR_CERT_AUTHORITY_INVALID) |
| Safari | "This Connection Is Not Private" for the self-signed certificate |
How site owners fix it
Clearing the old certificate from Firefox fixes it once; a certificate with a random serial stops it from returning.
1. Clear the stored certificate in Firefox. Settings > Privacy & Security > Certificates > View Certificates. Check the Servers, Authorities and Others tabs for entries naming the device or its IP address, delete them, and reload.
2. Give the device a certificate with a random serial. OpenSSL uses a random serial by default when you do not pass -set_serial:
openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
-keyout router.key -out router.crt -subj "/CN=router.example.com" \
-addext "subjectAltName=DNS:router.example.com,IP:203.0.113.10"
The self-signed certificate generator does the same with a random serial.
3. Better still, use a publicly trusted certificate for a real hostname via DNS validation, which removes both the self-signed warning and serial collisions. Decode the result with the certificate decoder to confirm the serial is long and random.
FAQ
Is SEC_ERROR_REUSED_ISSUER_AND_SERIAL dangerous?
On your own router or NAS it is almost always harmless: the device regenerated its self-signed certificate. On a public website it would be unusual and worth reporting, because public CAs must use unique random serial numbers.
Why do Chrome and Edge open the same page?
They do not keep a persistent record of previously seen self-signed certificates the way Firefox does, so a reused serial does not conflict with anything stored.
Will deleting cert9.db fix it?
Yes, but it also removes every certificate and exception you have stored in that Firefox profile. Deleting only the specific entry under View Certificates is more precise.
The error comes back after every router reboot. What now?
Some devices create a fresh self-signed certificate at every boot while keeping the same serial. Clearing Firefox each time is tedious; instead, upload your own certificate to the device if its admin page allows it, or reach the device through a hostname with a proper certificate. If neither is possible, ask the vendor for a firmware fix.