Cipher missing from server post Server Certificate renewal

prashant.joshi

Did twice but no luck...

NightlyShark

@prashant-joshi You deleted and recreated the server cert twice? Maybe you selected something in "Hardware Crypto"?

prashant.joshi

@NightlyShark I have simply renewed the cert not deleted the olderone.

NightlyShark

@prashant-joshi I had stumbled upon a bug, where if the cert took a long time to generate (tried 16k RSA), the gui would behave like it had finished with the cert, but a background process remained active (creating the cert), for up to 20 minutes later...

prashant.joshi

@NightlyShark in my case cert shows properly renewed.

Another thing I tried to save server settings it's giving me the "One or more of the selected Data Encryption Algorithms is not valid." error

NightlyShark

@prashant-joshi That means that when renewing the cert you changed ciphers and now it gets all confused. Just delete, both the cert and the server profile, and recreate. Unless there is a Gateway or a custom OpenVPN interface (for the fw rules) involved, then just try to delete the cert.

NightlyShark

@prashant-joshi Also, check out the logs for OpenVPN.

prashant.joshi

@NightlyShark when I am trying to add new server still the left side Cipher is blank.

alt text

NightlyShark

@prashant-joshi You need to select a certificate, first :)

prashant.joshi

@NightlyShark Even after selecting the server Cert nothing changed. Still the left side is missing and blank.

NightlyShark

@prashant-joshi Friend, I am this close to asking a stranger(you) to let me AnyDesk this...

NightlyShark

@prashant-joshi At this point of the head-scratching process, I would reinstall (remove and install) the OpenVPN package manually via cli.

johnpoz

@Gertjan are you really on 23.05.1 ? I would move to current supported version 23.09.1 - there has been multiple changes, big one is jump to open ssl3, and I know the openvpn version has also been updated.

23.05.1 is no longer on the supported list.

If it was me, I would upgrade to current, and if your certs are still not working... Create new..

NightlyShark

@johnpoz We tried TS via anydesk (as securely as possible...) and in the end, it was throwing the "libssl.so.30 not found" error. In about 3 hours (when their workplace will empty) they will attempt the update.

I wonder why I was spared from that when I updated, with my 2+ year old certs... Maybe because I have everything ECDSA.

johnpoz

@NightlyShark said in Cipher missing from server post Server Certificate renewal:

ECDSA

I am pretty much exclusively using those.. I just created a couple for my new cams I got.. I might have some older but have started using those for the last few years.. And using those for my openvpn stuff.

NightlyShark

@johnpoz And... a little bird told me that the only secure curve that was not recommended by certain people that are known to be allergic to public encryption (caugh, PRISM!, caugh) was secp521r1...

NightlyShark

@johnpoz That little bird is google, ok? hahaha

Gertjan

@NightlyShark said in Cipher missing from server post Server Certificate renewal:

"libssl.so.30 not found"

That's your system telling you : don't stay on older versions of pfSense. Upgrade to the actual version (23.09.1) asap and you'll be fine.
And note somewhere for the future : "never ever upgrade / install / 'do things with' packages before you've upgrade pfSense to the latest available version first".

NightlyShark

@Gertjan It's not my system... Not my thread, even. I just talk too much, hahaha.

Gertjan

@johnpoz said in Cipher missing from server post Server Certificate renewal:

@Gertjan are you really on 23.05.1 ?

Me ? Your kidding. 23.05.1 was ok, probably, I don't remember, 23.09.1 is pretty rock solid (for me). "VPN" (server) works well.
My bird says : if update is available, let the dust settle for a couple of days, and then click : upgrade.

Btw : I've still my 10 years certs in service :

Total Lifetime: 3650 days
Lifetime Remaining: 1027 days until expiration

These were the less secure days I guess ...