letsencrypt webconfigurator certificate expired - but it isn't!
-
Hi,
So I have been running pfsense for a couple of years now and I use the acme client to obtain letsencrypt certificates that haproxy uses. All of them are (also) wildcard certificates.
One of those wildcard certificates I also use for the pfsense webconfigurator so that I can connect to pfsense.example.com. A while ago I started to get an error message in my browser that this certificate has expired (and now I can only connect via the IP address).
But when I look on the acme certificates page, I can see that the certificate is not expired (but has been successfully renewed). And the same certificate works fine in haproxy.
So what is going on?
Any ideas? Thanks!
-
@sensewolf might need to restart the webgui to pick up the new cert..
what browser are you using - that doesn't let you proceed anyway after the warning?
-
You've checked System > Advanced > Admin Access ?
What cert is the GUI using ?
( you're using haproxy - not usre if the GUI cert is important or if the GUI is even using TLS ... ) -
@johnpoz Thank you! That did the trick.
For future reference, this is how I restarted the webgui:
Diagnostics > Command Prompt > Execute Shell Command: "/etc/rc.restart_webgui"
I'm using Firefox which sometimes can be a bit over protective ;)
-
Thank you for the hint! The GUI is using that particular cert. System > Certificates > Certificates also shows that cert as being used by "webConfigurator".
But as johnpoz suggested, webConfigurator apparently wasn't picking up the renewed cert.
-
@sensewolf said in letsencrypt webconfigurator certificate expired - but it isn't!:
But as johnpoz suggested, webConfigurator apparently wasn't picking up the renewed cert.
"Impossible ?!
".See for yourself :
Isn't the /etc/etc/rc.restart_webgui - look again at the Examples help text - mandatory ??
This line will restart the web GUI server when the certificate was renewed. -
@sensewolf restart the gui
And yeah if your using acme for your webgui - then that command @Gertjan shows should be in your acme client.
I don't have it because I don't use them in my gui, only for my haproxy stuff
