Certificate error

[stephenw10]

That can't work because there's no way to add the CA cert to the client so it will accept it.

You need to create a CA in pfSense. Use that to create a new server cert to use for the webgui. The import the CA cert ito the client so it trusts the server cert.

[Antibiotic]

@johnpoz I dont understanding. do I need to create additional CA client sert and put him to Windows trust cert as well?

[stephenw10]

Windows needs the CA cert so that when it sees the server cert in pfSense created by that it will trust it.

[Antibiotic]

@stephenw10 So , i need to delete default pfsense web gui cert. Creare new server and client cert and put both to Windows trust store?

[stephenw10]

Well I wouldn't delete the old webgui (server) cert before you created a new one! I don't think pfSense will allow you to do that.

Windows only needs the CA cert.

[Antibiotic]

@stephenw10 I did , put client CA to windows trsted store but nit working(((

[stephenw10]

Same error?

I would expect that to work so I would check the Windows has actually imported it correctly.

[Antibiotic]

@stephenw10 Yes same error

[Antibiotic]

@johnpoz

https://forum.netgate.com/topic/187774/port-restriction-rule

[the other]

@Antibiotic hm, strange...
I just imported my self-signed CA cert in my browsers certs (works for firefox as well as cromium under ubuntu, even working for androids).
With ubuntu I just put my CA cert into my browser's cert place, with android I imported into system. Both working...

So, did you import the CA cert or a server cert done with that CA? You need the former... :)

[Antibiotic]

@the-other I import CA client cert manually to trust store ,but its windows machines

[stephenw10]

@Antibiotic said in Certificate error:

I import CA client cert

There is no 'CA client cert' there is just the CA cert. This:

[Antibiotic]

@stephenw10

Creafed 2 cert for server and client and put to windows trust
store HomeCA

[stephenw10]

You exported the HomeCA cert from pfSense and imported it into Windows?

[the other]

@Antibiotic hey there,
to get rid of that warning, this works for me (and should in general):
go to your own CA in pfsense, export its cert (second from the left symbol), save it in your downloads directory...(or as needed)
Then open your firefox browser: go to settings > security > certificates here press show certificates.
Then go to tab certificate authorities, here press import. Import your saved CA cert. Close browser.
Start browser, go to your pfsense gui. If everything is done correctly the warning should be gone. Instead the lock symbol is showing a safe connection, moving the cursor on it should show something like "certified by YOUR CA NAME".
Delete that CA cert from your pc. Your browser should now know (and trust) pfsense's webserver cert, since it knows the CA (imported certificate)...

[Antibiotic]

@stephenw10 yes

[johnpoz]

@Antibiotic here is walk through I did back in 2019

https://forum.netgate.com/post/831783

[Antibiotic]

@johnpoz Thanks, this guide work for me as well)))

[johnpoz]

@Antibiotic glad you got it sorted.. The only bad thing is browsers now complain about long life certs.. I think something like 398 days or something max..

Use to be able to create a cert good for 10 years, and have no worries most likely for the life of the equipment you were using it on.. Now you have to renew it every year or so..

Now that you have a CA your browser trusts you can sign certs with if for all your devices that use a webgui.. So you can get your browser to stop complaining for stuff like switches, printers, other software.. My nas and unifi controllers webguis all use certs signed by my home CA..

Since your using your own CA you can create certs for any domain you want to use, home.arpa for example - or the new .internal that also intended for local use. You can add rfc1918 IPs in you the SAN so that even when you access via IP vs fqdn your browser won't complain.

Sure ACME has been a game changer for Certs.. And is great for something that a browser you do not control will be accessing. I use them for services I expose to the public. But 90 day renew kind of pain, even if can be automated. But you have to use a public domain, which can be problematic to use internally to be honest, you can not add rfc1918 IPs.. For the admin guis of stuff you admin, with your devices - use of your own CA is better option imho..

[Antibiotic]

@johnpoz said in Certificate error:

complain about long life certs

I use edge and don't have any complains about that 10 years cert, do not see any warnings)))