# SEC_ERROR_REUSED_ISSUER_AND_SERIAL: duplicate serial number

> Firefox shows SEC_ERROR_REUSED_ISSUER_AND_SERIAL when two certificates share an issuer and serial number, typically a router or NAS that regenerated one.

Source: https://ssl.sh/errors/sec-error-reused-issuer-and-serial/
Last updated: 2026-11-10

**SEC_ERROR_REUSED_ISSUER_AND_SERIAL means Firefox already knows a different certificate with the same issuer and serial number as the one this site presented.** That breaks a basic rule of X.509, so Firefox stops. It usually happens when a router, NAS or test server regenerates its self-signed certificate but reuses the same serial number, and Firefox remembers the old one.

## Is it the site or your device?

Both are involved: the device produced a non-unique certificate, and your Firefox profile stored the previous one. If the host is public, check it with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

A publicly trusted certificate should never cause this, because public CAs must use unique, random serial numbers. For devices on your own network, the fix is local and safe.

## Causes

### 1. Device regenerated its self-signed certificate

After a firmware update, factory reset or hostname change, many devices create a new certificate with the same issuer name and a fixed serial (often 0, 1 or 1000). Firefox still has the old certificate stored from an earlier exception. Inspect the serial:

```bash
echo | openssl s_client -connect 203.0.113.10:443 2>/dev/null | openssl x509 -noout -serial -issuer -dates
```

### 2. Several devices with identical factory certificates

Two units of the same model may ship certificates with the same issuer and serial but different keys. Visiting both triggers the error.

### 3. Test certificates made with a fixed serial

Scripts that create certificates with `-set_serial 1` every time produce duplicates. Each new test certificate then collides with the last.

### 4. Internal CA with a broken serial counter

A restored CA backup or a reset serial file can reissue serial numbers that were already used.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Secure Connection Failed" with "Your certificate contains the same serial number as another certificate issued by the certificate authority" and `SEC_ERROR_REUSED_ISSUER_AND_SERIAL` |
| Chrome / Edge | Usually a normal self-signed warning ([NET::ERR_CERT_AUTHORITY_INVALID](https://ssl.sh/errors/net-err-cert-authority-invalid/)) |
| Safari | "This Connection Is Not Private" for the self-signed certificate |

## How site owners fix it

Clearing the old certificate from Firefox fixes it once; a certificate with a random serial stops it from returning.

**1. Clear the stored certificate in Firefox.** Settings > Privacy & Security > Certificates > View Certificates. Check the Servers, Authorities and Others tabs for entries naming the device or its IP address, delete them, and reload.

**2. Give the device a certificate with a random serial.** OpenSSL uses a random serial by default when you do not pass `-set_serial`:

```bash
openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
  -keyout router.key -out router.crt -subj "/CN=router.example.com" \
  -addext "subjectAltName=DNS:router.example.com,IP:203.0.113.10"
```

The [self-signed certificate generator](https://ssl.sh/tools/self-signed-certificate-generator/) does the same with a random serial.

**3. Better still,** use a publicly trusted certificate for a real hostname via DNS validation, which removes both the self-signed warning and serial collisions. Decode the result with the [certificate decoder](https://ssl.sh/tools/certificate-decoder/) to confirm the serial is long and random.