letsencrypt webconfigurator certificate expired - but it isn't!

[sensewolf]

Hi,

So I have been running pfsense for a couple of years now and I use the acme client to obtain letsencrypt certificates that haproxy uses. All of them are (also) wildcard certificates.

One of those wildcard certificates I also use for the pfsense webconfigurator so that I can connect to pfsense.example.com. A while ago I started to get an error message in my browser that this certificate has expired (and now I can only connect via the IP address).

But when I look on the acme certificates page, I can see that the certificate is not expired (but has been successfully renewed). And the same certificate works fine in haproxy.

So what is going on?

Any ideas? Thanks!

[johnpoz]

@sensewolf might need to restart the webgui to pick up the new cert..

what browser are you using - that doesn't let you proceed anyway after the warning?

[Gertjan]

@sensewolf

You've checked System > Advanced > Admin Access ?
What cert is the GUI using ?
( you're using haproxy - not usre if the GUI cert is important or if the GUI is even using TLS ... )

[sensewolf]

@johnpoz Thank you! That did the trick.

For future reference, this is how I restarted the webgui:

Diagnostics > Command Prompt > Execute Shell Command: "/etc/rc.restart_webgui"

I'm using Firefox which sometimes can be a bit over protective ;)

[sensewolf]

@Gertjan

Thank you for the hint! The GUI is using that particular cert. System > Certificates > Certificates also shows that cert as being used by "webConfigurator".

But as johnpoz suggested, webConfigurator apparently wasn't picking up the renewed cert.

[Gertjan]

@sensewolf said in letsencrypt webconfigurator certificate expired - but it isn't!:

But as johnpoz suggested, webConfigurator apparently wasn't picking up the renewed cert.

"Impossible ?! ".

See for yourself :
login-to-view

Isn't the /etc/etc/rc.restart_webgui - look again at the Examples help text - mandatory ??
This line will restart the web GUI server when the certificate was renewed.

[johnpoz]

@sensewolf restart the gui

login-to-view

And yeah if your using acme for your webgui - then that command @Gertjan shows should be in your acme client.

I don't have it because I don't use them in my gui, only for my haproxy stuff

login-to-view