pkg: Certificate verification failed for /CN=*.netgate.com

decibel83

Hello,
I don't have any package available in the package manager:

Screenshot 2024-04-19 at 23.06.01.png

So I connected to the console and tried to bootstrap pkg:

[2.6.0-RELEASE][admin@fw]/: pkg bootstrap -f
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+https://pkg.pfsense.org/pfSense_v2_6_0_amd64-pfSense_v2_6_0, please wait...
Certificate verification failed for /CN=*.netgate.com
34372542464:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-img-build/BUILD_NODE/amd64-ce/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/sources/FreeBSD-src-RELENG_2_6_0/crypto/openssl/ssl/statem/statem_clnt.c:1916:
Certificate verification failed for /CN=*.netgate.com
34372542464:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-img-build/BUILD_NODE/amd64-ce/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/sources/FreeBSD-src-RELENG_2_6_0/crypto/openssl/ssl/statem/statem_clnt.c:1916:
Certificate verification failed for /CN=*.netgate.com
34372542464:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-img-build/BUILD_NODE/amd64-ce/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/sources/FreeBSD-src-RELENG_2_6_0/crypto/openssl/ssl/statem/statem_clnt.c:1916:
Certificate verification failed for /CN=*.netgate.com
34372542464:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-img-build/BUILD_NODE/amd64-ce/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/sources/FreeBSD-src-RELENG_2_6_0/crypto/openssl/ssl/statem/statem_clnt.c:1916:
Certificate verification failed for /CN=*.netgate.com
34372542464:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-img-build/BUILD_NODE/amd64-ce/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/sources/FreeBSD-src-RELENG_2_6_0/crypto/openssl/ssl/statem/statem_clnt.c:1916:
Certificate verification failed for /CN=*.netgate.com
34372542464:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-img-build/BUILD_NODE/amd64-ce/OS_MAJOR_VERSION/freebsd12/PLATFORM/aws/sources/FreeBSD-src-RELENG_2_6_0/crypto/openssl/ssl/statem/statem_clnt.c:1916:
pkg: Error fetching https://pkg.pfsense.org/pfSense_v2_6_0_amd64-pfSense_v2_6_0/Latest/pkg.txz: Authentication error
A pre-built version of pkg could not be found for your system.
Consider changing PACKAGESITE or installing it from ports: 'ports-mgmt/pkg'.

I tried to rehash the SSL certificates without success:

[2.6.0-RELEASE][admin@fw1.dc.ems.network]/: certctl rehash
Scanning /usr/share/certs/blacklisted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...

I've already read the Troubleshooting Upgrades document.

Could you help me please?
Thank you very much!

nmo

[2.7.2-RELEASE][admin@pfSense.lan]/root: openssl s_client -connect pkg01-atx.netgate.com:443 -verify_quiet
CONNECTED(00000003)
depth=0 CN = *.netgate.com
verify error:num=20:unable to get local issuer certificate
depth=0 CN = *.netgate.com
verify error:num=21:unable to verify the first certificate
Certificate chain

source: https://www.reddit.com/r/PFSENSE/comments/1c84y8b/pkg_an_error_occured_while_fetching_package/

There are issues in netgate's cert chain

decibel83

@nmo thank you.

So I just have to wait Netgate to fix the issue?

johnpoz

@decibel83 not seeing this on my 23.09.1, but yeah just fired up my 2.7.2 CE vm and is not able to grab packages.

Normally such issues are corrected fairly quickly..

stephenw10

Hmm, checking...

stephenw10

Try again now.

johnpoz

@stephenw10 nope I still show it not working on my 2.7.2 box

johnpoz

@stephenw10 ok its working now

I did a bootstrap and still wasn't working

But I then rebooted it and worked, so maybe I was just too fast and would of worked without the reboot, or maybe the reboot did something? Normally I would never reboot, but it running on just a vm, so takes a few seconds to reboot and nothing routing through it, etc.. that I would be worried about loosing connections on.

stephenw10

Mmm, should not have required boot-strapping as far as I know.

johnpoz

@stephenw10 when it didn't work right away figured couldn't hurt, and still didn't work. Maybe if would of just waited a few minutes it would of been fine without doing anything