Invalid SSL certificate after rebootstrapping

[Nicola Larosa]

THe Juju GUI connects to the Juju API WebSocket via SSL when so configured.

When Juju uses a self-signed SSL certificate, it gets reused upon rebootstrapping.

When first boostrapping Juju, for Juju GUI to be able to access the Juju API WebSocket, said WebSocket has to be first accessed manually so that the the user can accept the self-signed certificate issued by Juju.

When using Firefox, after rebootstrapping Juju and accessing the WebSocket port via SSL again: <https://hostname:17070/>, since Juju reuses the previously generated self-signed certificate, but now it is deployed on a host at a different address, Firefox displays an invalid server certificate with the following error:

"Your certificate contains the same serial number as another certificate issued by the certificate authority. Please get a new certificate containing a unique serial number."

[William Reade (fwereade)]

Nicola, sorry, I'm missing context. Would you explain what you did in a bit more detail please?

[Nicola Larosa (teknico)]

William, sorry for the vagueness. I changed the bug description adding all context that I can retrieve from my memory. It may be all, in part or not at all relevant to the current situation. :-)

[William Reade (fwereade)]

Sorry, this is actually perfectly clear. We should destroy certs/keys at destroy-environment time.

[William Reade (fwereade)]

OK, we generate a new server cert with the same CA cert -- but we reuse the serial number, which is not OK. See cert/cert.go:154 and http://www.ietf.org/rfc/rfc2459.txt section 4.1.2.2