PHP Fatal Error

stephenw10

So it regenerates exactly the same error everytime the ACME cert renew script runs?

And this just started happening, it didn't start after upgrading for example?

dersch

@stephenw10 No, the cert is issued correctly. It is just not used anymore be the pfsense webserver. Sometimes i need to restart the webgui with /etc/rc.restart_webgui after a new cert has been issued periodically. So i did and then this error comes up. Now it comes again and again with the restart of the webgui. And after the upgrade to 23.5.01 the old cert was still in use. Only now after the new one has been issued this happens.

jimp

How are you triggering a restart of the GUI from ACME?

dersch

@jimp i dosen't, i do it manually via cli command

jimp

If you are trying that from your own non-root user then I could see it generating a PHP error because it lacks the privileges.

But ACME is capable of restarting the GUI on its own properly as a part of the renewal process, it's one of the given examples in the settings for each certificate:

Only root/admin could run that at the CLI over SSH, other accounts would need to run it through sudo.

dersch

@jimp you are right but anyway sometimes i had to restart it (with root) manually from the cli. Now i just noticed the unsecure warning by accessing https of the pfsense. So i have checked acme and found a correct reissued cert. Then i tried to restart the webgui to exclude that point and this error occured.

now this is a yellow warning in the webgui:

Crash report begins.  Anonymous machine information:

amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT #1 plus-RELENG_23_05_1-n256108-459fc493a87: Wed Jun 28 04:26:04 UTC 2023     root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-23_05_1-main/obj/amd64/f2Em2w3l/var/jenkins/workspace/pfSense-Plus-snapshots-23_05_1-main/sources/

Crash report details:

PHP Errors:
[17-Oct-2023 10:04:51 Europe/Berlin] PHP Fatal error:  Uncaught TypeError: fwrite(): Argument #1 ($stream) must be of type resource, bool given in /etc/inc/rrd.inc:1027
Stack trace:
#0 /etc/inc/rrd.inc(1027): fwrite(false, '#!/bin/sh\n\nexpo...')
#1 /etc/rc.restart_webgui(44): enable_rrd_graphing()
#2 {main}
  thrown in /etc/inc/rrd.inc on line 1027



No FreeBSD crash data found.

also the new reissued cert is not being used by the webserver.

stephenw10

How are you restarting the GUI? From what user?

dersch

@stephenw10 as i said root

stephenw10

Ok, but using what command? Option 11 from the console menu?

dersch

@stephenw10 sorry but again as i wrote with
/etc/rc.restart_webgui

Gertjan

@dersch said in PHP Fatal Error:

Restarting webConfigurator...Error: cannot open certificate file in system_webgui_start().

Just some checks.
When the GUI restarts, it need some file to be present.
Two of these files are the certificate files.

All the certificate files are stored in the GUI System > Certificate Manager > Certificates
You can (should) also check their existence in the main pfSense config file : //cf/conf/config.xml

When the GUI is restarted, the web server's config file is created form 'scratch' : here it is : var/etc/nginx-webConfigurator.conf
It references wto ceryticate files :
/var/etc/cert.key
and
/var/etc/cert.crt

This :

[23.05.1-RELEASE][root@pfSense.bhf.net]/root: ls -al /var/etc/cert.* /var/etc/nginx-webConfigurator.conf
-rw-r--r--  1 root  wheel  5564 Oct 11 16:11 /var/etc/cert.crt
-rw-------  1 root  wheel  1675 Oct 11 16:11 /var/etc/cert.key
-rw-r--r--  1 root  wheel  2449 Oct 11 16:11 /var/etc/nginx-webConfigurator.conf

shows that they are all created at the same moment : the last time the GUI was restarted.

Your issue : 'Error: cannot open certificate file in system_webgui_start()' means : the (one of the) cert files doesn't exist. or : it couldn't we created -written out.
This can be : the script make the files didn't have to write the file - or it was not possible because there was no (disk) space.

You have other file write errors :

@dersch said in PHP Fatal Error:

fwrite(false, '#!/bin/sh\n\nexpo...')

The 'false' here should be the file descriptor, typically some integer value, not a 'false' value, which is created when "opening" a file (for writing). That "opening" failed. Again : most typical reasons : no rights ... or no place.

edit : I'm now thinking out loud :
You saw the issue right after a acme cert renewal.
The acme pfSense package keeps its working files in /tmp/acme/...
The /tmp/ folder is emptied on every system boot.
When acme starts, it creates some config files, and then talks to the the Letsenscrtpt server to do the magic.
And it creates an ever growing log file ... see it here : /temp/acme/[cert-name]/acme_issuecert.log
acme logs a lot and thayt's ok, its performing some real rocket science.
So, if there was a disk space issue before acme started, after acme is done, the issue is even worse.

Ximulate

I've noticed the same issue. Running CE 2.7. Internet goes down & typically can't log into the webConfigurator requiring a hard reset. I'm wondering if it may be the email notification service failing to login to the smtp server (due to the internet going down.) I disabled the smtp notification for now. I was having another issue recently, which now I wonder if this is related.

[24-Nov-2023 13:12:20 America/New_York] PHP Fatal error:  Uncaught TypeError: fwrite(): Argument #1 ($stream) must be of type resource, bool given in /etc/inc/config.lib.inc:172
Stack trace:
#0 /etc/inc/config.lib.inc(172): fwrite(false, 'a:37:{s:7:"vers...')
#1 /etc/inc/config.lib.inc(147): generate_config_cache(Array)
#2 /etc/inc/config.inc(141): parse_config()
#3 /etc/inc/gwlb.inc(25): require_once('/etc/inc/config...')
#4 /etc/inc/functions.inc(35): require_once('/etc/inc/gwlb.i...')
#5 /etc/inc/notices.inc(26): require_once('/etc/inc/functi...')
#6 /usr/local/pkg/nut/nut_email.php(24): require_once('/etc/inc/notice...')
#7 {main}
  thrown in /etc/inc/config.lib.inc on line 172
[24-Nov-2023 13:12:20 America/New_York] PHP Fatal error:  Uncaught ValueError: Path cannot be empty in /etc/inc/notices.inc:101
Stack trace:
#0 /etc/inc/notices.inc(101): fopen('', 'w')
#1 /etc/inc/config.lib.inc(1148): file_notice('phperror', 'PHP ERROR: Type...', 'PHP errors')
#2 [internal function]: pfSense_clear_globals()
#3 {main}
  thrown in /etc/inc/notices.inc on line 101

stephenw10

That's this: https://redmine.pfsense.org/issues/14432 which as noted is actually an error writing to the filesystem. Is your drive full?

Ximulate

@stephenw10
No. 1.1G used out of 11G

stephenw10

Hmm, OK. And that's in 2.7.1?

Ximulate

@stephenw10

2.7.0
I now see 2.7.1 is out, so I'll upgrade shortly