Reolink: please don't reuse your HTTPS certificates SEC_ERROR_REUSED_ISSUER_AND_SERIAL

[Ben L_363180304232580]

For at least some cameras Reolink have been reusing the same HTTPS / TLS certificate details - including serial number - for their self-signed certificates. FTR, the use of a self-signed certificate is fine and unavoidable, there's not much Reolink can practically do about that. But they can at least ship self-signed certs that do not cause problems when you have more than one of their cameras!

The error is SEC_ERROR_REUSED_ISSUER_AND_SERIAL, and indeed this is the case, here are the details from two reolink cameras - note the certificate details are identical (case insensitive) and serial number is 01 for both. Reolink should create the certificate with a random number or a timestamp or the camera's serial number, or anything except repeat the same value for different devices.

Connecting to 192.168.41.18
depth=0 C=CN, ST=GD, L=SZ, O=CERTIFICATE, OU=CERTIFICATE, CN=CERTIFICATE, emailAddress=CERTIFICATE<at>CERTIFICATE
verify error:num=18:self-signed certificate
verify return:1
depth=0 C=CN, ST=GD, L=SZ, O=CERTIFICATE, OU=CERTIFICATE, CN=CERTIFICATE, emailAddress=CERTIFICATE<at>CERTIFICATE
verify return:1
DONE
serial=01

Connecting to 192.168.41.20
depth=0 C=CN, ST=GD, L=SZ, O=certificate, OU=certificate, CN=certificate, emailAddress=certificate<at>certificate
verify error:num=18:self-signed certificate
verify return:1
depth=0 C=CN, ST=GD, L=SZ, O=certificate, OU=certificate, CN=certificate, emailAddress=certificate<at>certificate
verify return:1
DONE
serial=01

(had to edit the above to be able to post this; replace <at> with @; add .com)