OpenSSL Library Error when Creating New Certificate

johnpoz

@nanobist can you post exactly what your putting in when you try and create a cert, because not able to reproduce this problem either. Not on 2.6, not on 2.7 snap not on 23.05..

nanobist

file:///home/ldavidson/Pictures/Screenshots/Screenshot%20from%202023-06-15%2015-41-06.png

nanobist

Resulting in this error:

stephenw10

You didn't add the Country, State, City, Org data to the CA. The cert tries to use those by default and it's probably failing on that.

nanobist

If I add that information I get more errors:

    OpenSSL Library Error: error:2206D06C:X509 V3 routines:X509V3_parse_list:invalid null name
    OpenSSL Library Error: error:22097069:X509 V3 routines:do_ext_nconf:invalid extension string
    OpenSSL Library Error: error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension
    OpenSSL Library Error: error:0909006C:PEM routines:get_name:no start line
    OpenSSL Library Error: error:2206D06C:X509 V3 routines:X509V3_parse_list:invalid null name
    OpenSSL Library Error: error:22097069:X509 V3 routines:do_ext_nconf:invalid extension string
    OpenSSL Library Error: error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension

johnpoz

@nanobist ok just fired up my 2.6 vm, and duplicating your settings works just fine..

Clearly something messed up.. Did you install any 3rd party package, packages from the package manager. Is this an upgrade from old pfsense, new clean install of 2.6?

nanobist

Thanks for checking. You think it is time for a reinstall? Maybe this will be my excuse to finally virtualize my pfsense box.

johnpoz

@nanobist said in OpenSSL Library Error when Creating New Certificate:

my excuse to finally virtualize my pfsense box.

While I ran virtual for a very long time, and loved the ability to just easy rollback if anything went wrong - gave me piece of mind when playing with latest and greatest snaps of upcoming versions, etc.

I prob wouldn't go back to running virtual - nice having hardware, allows me do other stuff with my vm host without having to worry about loosing internet..

So it is for sure a + or - sort of thing running virtual as your main router/firewall. Now if I want to play I just run a vm as lab only, and not the actual router/firewall for my network.

nanobist

I almost pulled the trigger on virtualizing it just now but I figure that is making things more complex than what I really need. To wrap this up I finished up the reinstall and restore and all is well now. I was able to create an internal CA and cert without issue. Thanks to both of you for the help.

johnpoz

@nanobist said in OpenSSL Library Error when Creating New Certificate:

but I figure that is making things more complex than what I really need.

Yeah it does add a bit of complexity - but again + and - to any sort of setup really. There are things I really like about a virtual router, but me personally prob wouldn't go back to that setup..

In a pinch I could run a virtual router - say my pfsense box went belly up, knock on wood I could always fire up the virtual router until my replacement hardware got here ;)

Maybe you want to fire up a "lab" if you will vm - then if need be a bit of changing some ports around on the switch and bam your in business again ;) That is my DR plan, again knock on wood ;)