Pfsense 2.6 to plus. Unable to check

Antibiotic

Magic become))) Upgrade done!

Michael.Schmalzl

@antibiotic Same on here.
Woke up, checked it on my tablet and run the upgrade and installed all the things I needed.
But the root cause would be interesting.

Antibiotic

The most funny things that now after success upgrade from CE to 23.01 again mistake:
pdating pfSense-core repository catalogue...
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz: Bad Request
repository pfSense-core has no meta file, using default settings. Please fix this!

Antibiotic

My list of available packages are empty now. Can not install any soft))))

Antibiotic

Error going :
Error updating repositories!
ERROR: It was not possible to determine pfSense-upgrade remote version

Antibiotic

Next error :
A pre-built version of pkg could not be found for your system.
Consider changing PACKAGESITE or installing it from ports: 'ports-mgmt/pkg'

Antibiotic

Have no idea, what is going on!

Antibiotic

Could be to assist for someone. Did fresh renew of Pfsense webConfigurator certificate in strict security mode and after reboot magic happened)))Packages become available)))

barnops

@antibiotic said in Pfsense 2.6 to plus. Unable to check:

Please fix this issue as I'm check on forum it happened sometimes. Did install fresh copy of pfsense 2.6 and unlucky now))) , to upgrade. Error:Could not load client certificate /etc/ssl/pfSense-repo-custom.cert
pkg: https://pfsense-plus-pkg01.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz: Authentication error
repository pfSense-core has no meta file, using default settings

Same.

1 week ago I upgraded a firewall from 2.6 to Plus, then to 23.01.

Today I went to upgrade a 2nd firewall and am encountering this issue...so it cropped up sometime in the last 7 days.
I first factory reset and attempted the update prior to restoring my backup.

First "Could not load client certificate...."
I remedied this by copying the cert and KEY from the working firewall.

Now I am presented with:
Updating pfSense-core repository catalogue...
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/meta.txz: Bad Request
repository pfSense-core has no meta file, using default settings
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.pkg: Bad Request
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-core/packagesite.txz: Bad Request
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01//meta.txz: Bad Request
repository pfSense has no meta file, using default settings
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01//packagesite.pkg: Bad Request
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01//packagesite.txz: Bad Request
Unable to update repository pfSense
Error updating repositories!

If I run "pkg bootstrap -f" I get this back:

The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/, please wait...
pkg: Error fetching https://pfsense-plus-pkg.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01//Latest/pkg.txz: Bad Request
A pre-built version of pkg could not be found for your system.
Consider changing PACKAGESITE or installing it from ports: 'ports-mgmt/pkg'.

I can't update to Plus, and therefore can't upgrade to 23.01.....very annoying.

rcoleman-netgate

@barnops what do you get when you do

pfSense-upgrade -c

barnops

@rcoleman-netgate said in Pfsense 2.6 to plus. Unable to check:

@barnops what do you get when you do
pfSense-upgrade -c 

When set to the pfSense Plus Upgrade branch:
>>> Updating repositories metadata... failed.
ERROR: Unable to compare version of pfSense-repo

When set to the Stable (2.6) branch:
>>> Updating repositories metadata... done.
Your system is up to date

Antibiotic

@barnops Did you try my tip with web configurator certificate renewing?

rcoleman-netgate

@antibiotic This shouldn't have anything to do with this. The local GUI Cert is not related to repo access.

Antibiotic

@rcoleman-netgate roger that))))

barnops

@rcoleman-netgate said in Pfsense 2.6 to plus. Unable to check:

@antibiotic This shouldn't have anything to do with this. The local GUI Cert is not related to repo access.

But for the record, I did.
It didn't solve anything.

barnops

This post is deleted!

barnops

@barnops Also, interesting that the validity dates on this cert are expired.

openssl x509 -in /etc/ssl/pfSense-repo-custom.cert -text
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
7f:c3:e5:________________________:45:83:59:5a:08
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, ST = Texas, L = Austin, O = "Rubicon Communications, LLC (Netgate)", OU = ProdTrack CA, CN = ProdTrack CA
Validity
Not Before: Mar 10 19:01:29 2023 GMT
Not After : Mar 11 07:01:29 2023 GMT

JeGr

Perhaps related: since a reboot this morning I don't get any package repos with the following errors:

...shortened...

Updating pfSense repository catalogue...
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/meta.txz: Authentication error
repository pfSense has no meta file, using default settings
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.pkg: Authentication error
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
35160031232:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_01-main/sources/FreeBSD-src-plus-RELENG_23_01/crypto/openssl/ssl/statem/statem_clnt.c:1921:
pkg: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_01_amd64-pfSense_plus_v23_01/packagesite.txz: Authentication error
Unable to update repository pfSense
Error updating repositories!

barnops

Looks like whatever was going wrong was resolved this morning.
I am now able to pull the update version.

But wasn't it a requirement to swap to 22.01 first when upgrading from CE to Plus?
Now 23.01 is listed when going from 2.6.0.

barnops

@barnops said in Pfsense 2.6 to plus. Unable to check:

Looks like whatever was going wrong was resolved this morning.
I am now able to pull the update version.

But wasn't it a requirement to swap to 22.01 first when upgrading from CE to Plus?
Now 23.01 is listed when going from 2.6.0.

Seems like it updated properly to 23.01 with no ill effects:
Removing unnecessary packages... done.
Cleanup pkg cache... done.
pfSense 23.01-RELEASE amd64 Fri Feb 10 20:06:33 UTC 2023
Bootup complete

So what ended up being the issue?