Description

When two certificates are loaded onto the SRX with the same subject name, the second one will not be loaded and will throw an warning.

Symptoms

The first certificate will load successfully but when the second certificate is loaded, then the below warning will be seen.
 

error: Failed to write the CA certificate to local store


PKI traceoptions will consider the second certificate as a duplicate.


 pkid_add_to_lhash: ignore the duplicate entry           
Inside pkid_add_obj_to_lhash, object  of type <1> already exist.

Solution

This is an expected behaviour with PKI using Cert Subject name to distinguish between different certs.
Note that the PKI functionality is not impacted at all as a result of this Warning message.

 

PKI does not allow user to install two CA certs with same Issuer name by design.
Issuer name is a unique field and PKI uses this to distinguish certs .
If one CA cert is about to expire , then user can delete the CA cert and install a new one.
IPSEC tunnels will not be impacted when the old CA cert is removed .

Modification History

27/5/24: Validated article