Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    SSL certificate signed

    Scheduled Pinned Locked Moved webGUI
    35 Posts 8 Posters 26.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by

      If you can't retrieve a certificate under "Retrieve Certificate" then nothing has been generated yet.
      First: goto the "Validations Wizard" and do a "Domaine name validation".
      Then: goto "Certificates Wizard", select "Web server SSL/TLS Certificate" and run it down.

      Normally, I let them generate the files.
      Because I have a "Debian Jessie" server, I execute the "openssl rsa -in ssl.key -out ssl.key" myself with a detail:
      I use this:

      openssl rsa -in ssl.key -out ssl-decrypted.key

      this way I keep the original encrypted key and the decrypted key. You'll be needing the 'ssl-decypted.key' file afterwards.

      I'll join an image to motivate you  ;)

      startssl-pfsense.png
      startssl-pfsense.png_thumb

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      1 Reply Last reply Reply Quote 0
      • J
        JohnnyBeGood
        last edited by

        @Gertjan:

        If you can't retrieve a certificate under "Retrieve Certificate" then nothing has been generated yet.
        First: goto the "Validations Wizard" and do a "Domaine name validation".
        Then: goto "Certificates Wizard", select "Web server SSL/TLS Certificate" and run it down.

        Normally, I let them generate the files.
        Because I have a "Debian Jessie" server, I execute the "openssl rsa -in ssl.key -out ssl.key" myself with a detail:
        I use this:

        openssl rsa -in ssl.key -out ssl-decrypted.key

        this way I keep the original encrypted key and the decrypted key. You'll be needing the 'ssl-decypted.key' file afterwards.

        I'll join an image to motivate you  ;)

        Nice motivation :)

        I was able to get "Retrieve Certificate" working and the reason was because I never finished the process :(
        Now after I have both enter and without any errors like before I still get invalid, how did you "force" your browser to use new certificate?

        still.JPG

        I like to fill my tub up with water, then turn the shower on and act like I'm in a submarine that's been hit!

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Did you install the Intermediate as a CA?

          Did you install the StartSSL certificate?

          Does pfSense recognize that the Cert is signed by the CA?

          Did you tell the webgui to use the new certificate in System > Advanced > Admin Access??

          Does the hostname you're browsing to exactly match either the CN or a SAN in the certificate?

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • J
            JohnnyBeGood
            last edited by

            @Derelict:

            Did you install the Intermediate as a CA?

            Did you install the StartSSL certificate?

            Does pfSense recognize that the Cert is signed by the CA?

            Did you tell the webgui to use the new certificate in System > Advanced > Admin Access??

            Does the hostname you're browsing to exactly match either the CN or a SAN in the certificate?

            :(

            So I went to check if I was using new certificate under System > Advanced > Admin Access and when I change from self generated to the one I created now I stuck and cannot login into pfsense interface. In chrome I get:

            **This webpage is not available

            ERR_CONNECTION_TIMED_OUT**

            Tried w/ pfsense ip https://192.168.1.1 as well as domain that matched certificate https://linux.mydomain.net:81

            I like to fill my tub up with water, then turn the shower on and act like I'm in a submarine that's been hit!

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Tried w/ pfsense ip https://192.168.1.1 as well as domain that matched certificate https://linux.mydomain.net:81

              Connect to http://192.168.1.1/ and see what happens.

              Did you change the listening port?  You're trying https:// and https://host:81 there.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan
                last edited by

                @JohnnyBeGood:

                ….. now I stuck and cannot login into pfsense interface. In chrome I get:

                Been there - seen that.

                My 'solution' : SSH intp pfSense. Option 8: shell.

                Type
                viconfig

                Find
                <protocol>https</protocol>
                Change it for
                <protocol>http</protocol>
                Save.
                Reboot.

                Warning : editing the config.xml is "not done" (thats why it works ;)).
                You are using editor vi - its somewhat special.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • J
                  JohnnyBeGood
                  last edited by

                  @Gertjan:

                  @JohnnyBeGood:

                  ….. now I stuck and cannot login into pfsense interface. In chrome I get:

                  Been there - seen that.

                  My 'solution' : SSH intp pfSense. Option 8: shell.

                  Type
                  viconfig

                  Find
                  <protocol>https</protocol>
                  Change it for
                  <protocol>http</protocol>
                  Save.
                  Reboot.

                  Warning : editing the config.xml is "not done" (thats why it works ;)).
                  You are using editor vi - its somewhat special.

                  I'm glad I'm not the only one with this issue  ;)

                  So using Putty SSH I tried to connect to 192.168.1.1 but it keeps timing out. I'm assuming that SSH deamon is not enabled.
                  My next step would be to physically connect keyboard and monitor and try to connect that way. Are above steps the same?

                  I like to fill my tub up with water, then turn the shower on and act like I'm in a submarine that's been hit!

                  1 Reply Last reply Reply Quote 0
                  • J
                    JohnnyBeGood
                    last edited by

                    @Derelict:

                    Tried w/ pfsense ip https://192.168.1.1 as well as domain that matched certificate https://linux.mydomain.net:81

                    Connect to http://192.168.1.1/ and see what happens.

                    Did you change the listening port?  You're trying https:// and https://host:81 there.

                    I did try connecting to http://192.168.1.1/ but it does not connect.
                    Neither port 80 or 81 worked.

                    I like to fill my tub up with water, then turn the shower on and act like I'm in a submarine that's been hit!

                    1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan
                      last edited by

                      @JohnnyBeGood:

                      I'm assuming that SSH deamon is not enabled.

                      Possible.
                      But not for me.
                      A remote system without remote SSH enabled: unthinkable.
                      SSH is not some kind of 'emergency back door' : its the main maintenance port of any system. (GUI is just the next best thing)
                      For me, that is.  I guess its quiet usual for people born before 1970  ;)

                      @JohnnyBeGood:

                      My next step would be to physically connect keyboard and monitor and try to connect that way. Are above steps the same?

                      Of course.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 0
                      • J
                        JohnnyBeGood
                        last edited by

                        @Gertjan:

                        @JohnnyBeGood:

                        ….. now I stuck and cannot login into pfsense interface. In chrome I get:

                        Been there - seen that.

                        My 'solution' : SSH intp pfSense. Option 8: shell.

                        Type
                        viconfig

                        Find
                        <protocol>https</protocol>
                        Change it for
                        <protocol>http</protocol>
                        Save.
                        Reboot.

                        Warning : editing the config.xml is "not done" (thats why it works ;)).
                        You are using editor vi - its somewhat special.

                        Thanks for this, you're a life saver! I thought I need to re-install it  :'(

                        I like to fill my tub up with water, then turn the shower on and act like I'm in a submarine that's been hit!

                        1 Reply Last reply Reply Quote 0
                        • J
                          JohnnyBeGood
                          last edited by

                          @Derelict:

                          Did you install the Intermediate as a CA?

                          Did you install the StartSSL certificate?

                          Does pfSense recognize that the Cert is signed by the CA?

                          Did you tell the webgui to use the new certificate in System > Advanced > Admin Access??

                          Does the hostname you're browsing to exactly match either the CN or a SAN in the certificate?

                          Lets try this again since I got locked out  :(

                          Did you install the Intermediate as a CA?
                          I thought I did, please see attached screenshot.

                          Does pfSense recognize that the Cert is signed by the CA?
                          I think it does, please see attached.

                          Did you tell the webgui to use the new certificate in System > Advanced > Admin Access??
                          Everything was fine until I selected new certificate. After that that I was locked out until I tried Gertjan's solution.

                          Does the hostname you're browsing to exactly match either the CN or a SAN in the certificate?
                          When I created cert. it matched my pfSense hostname.

                          Why did I got locked out once I selected new cert?

                          CAs.JPG
                          CAs.JPG_thumb
                          certificates.JPG
                          certificates.JPG_thumb
                          advanced-admin-access.JPG
                          advanced-admin-access.JPG_thumb

                          I like to fill my tub up with water, then turn the shower on and act like I'm in a submarine that's been hit!

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            No.  You installed your certificate as a CA.  You need to install the StartSSL Class 1 Intermediate Server certificate as a CA.  Delete the Web gui linux from CAs and install this.

                            http://www.startssl.com/certs/sub.class1.server.ca.pem

                            –---BEGIN CERTIFICATE-----
                            MIIF2TCCA8GgAwIBAgIHFxU9nqs/vzANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQG
                            EwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERp
                            Z2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2Vy
                            dGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDcxMDE0MjA1NDE3WhcNMjIxMDE0MjA1
                            NDE3WjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzAp
                            BgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV
                            BAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgU2VydmVy
                            IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtonGrO8JUngHrJJj
                            0PREGBiEgFYfka7hh/oyULTTRwbw5gdfcA4Q9x3AzhA2NIVaD5Ksg8asWFI/ujjo
                            /OenJOJApgh2wJJuniptTT9uYSAK21ne0n1jsz5G/vohURjXzTCm7QduO3CHtPn6
                            6+6CPAVvkvek3AowHpNz/gfK11+AnSJYUq4G2ouHI2mw5CrY6oPSvfNx23BaKA+v
                            WjhwRRI/ME3NO68X5Q/LoKldSKqxYVDLNM08XMML6BDAjJvwAwNi/rJsPnIO7hxD
                            KslIDlc5xDEhyBDBLIf+VJVSH1I8MRKbf+fAoKVZ1eKPPvDVqOHXcDGpxLPPr21T
                            Lwb0pwIDAQABo4IBTDCCAUgwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E
                            BAMCAQYwHQYDVR0OBBYEFOtCNNCYsKuf9BtrCPfMZC7vDixFMB8GA1UdIwQYMBaA
                            FE4L7xqkQFulF2mHMMo0aEPQQa7yMGkGCCsGAQUFBwEBBF0wWzAnBggrBgEFBQcw
                            AYYbaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL2NhMDAGCCsGAQUFBzAChiRodHRw
                            Oi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwMgYDVR0fBCswKTAnoCWg
                            I4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMEMGA1UdIAQ8MDow
                            OAYEVR0gADAwMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9w
                            b2xpY3kucGRmMA0GCSqGSIb3DQEBCwUAA4ICAQCBnsOw7dxamNbdJb/ydkh4Qb6E
                            qgEU+G9hCCIGXwhWRZMYczNJMrpVvyLq5mNOmrFPC7bJrqYV+vEOYHNXrzthLyOG
                            FFOVQe2cxbmQecFOvbkWVlYAIaTG42sHKVi+RFsG2jRNZcFhHnsFnLPMyE6148lZ
                            wVdZGsxZvpeHReNUpW0jh7uq90sShFzHs4f7wJ5XmiHOL7fZbnFV6uE/OoFnBWif
                            CRnd9+RE3uCospESPCRPdbG+Q4GQ+MBS1moXDTRB6DcNoHvqC6eU3r8/Fn/DeA9w
                            9JHPXUfrAhZYKyOQUIqcfE5bvssaY+oODVxji6BMk8VSVHsJ4FSC1/7Pkt/UPoQp
                            FVh38wIJnvEUeNVmVl3HHFYTd50irdKYPBC63qi2V/YYI6bJKmbrjfP9Vhyt9uNr
                            y3Kh4W22ktDuCCvWC7n/gqerdq+VlTRfNt7D/mB0irnaKjEVNCXBXm9V/978J+Ez
                            8aplGZccQ9jnc9kiPtUp5dj45E3V8vKqzp9srSSI5Xapdg+ZcPY+6HNuVB+MadRp
                            ZW2One/Qnzg9B4GnVX7MOETImdoP4kXpostFuxoY/5LxCU1LJAIENV4txvT50lX2
                            GBXCkxllRLWOgdyll11ift/4IO1aCOGDijGIfh498YisM1LGxytmGcxvbJERVri+
                            gGpWAZ5J6dvtf0s+bA==
                            -----END CERTIFICATE-----

                            After that, when you look at your certificate, it should show as being issued by that cert (Issuer)…

                            ![Screen Shot 2015-09-17 at 10.19.58 PM.png](/public/imported_attachments/1/Screen Shot 2015-09-17 at 10.19.58 PM.png)
                            ![Screen Shot 2015-09-17 at 10.19.58 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-09-17 at 10.19.58 PM.png_thumb)

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              You know you could of just used pfsense self signed cert.. All you have to do is install the pfsense CA into your machine so that certs signed by that CA are trusted.  There is no reason to get a cert from startssl or anyplace be it free or not.

                              The only time you would need a cert from a public trusted CA would be for say our portal when clients that have not trusted pfsense CA would hit the page via https

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                That's your opinion. I get certs because I think it's inexcusable to have a user have to click through a certificate error. Trains them badly. With all the devices running around here and the amount of messing around I do, it's worth it to me to go through the yearly hassle of updating the certs with ones that won't throw errors at others.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Who said anything about users clicking through bad certs?  I completely agree with you.. Its my machine on a server I admin, I can trust whatever CA I want, now I don't get errors.. Don't have to add an exception, etc.

                                  Notice I did state if using for say a captive portal you would use a public trusted CA for that cert..

                                  Once you trust the CA none of the certs that CA would create would throw errors, etc..

                                  trustedca.png
                                  trustedca.png_thumb

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tsmets
                                    last edited by

                                    I also had what most had.
                                    Added the Class 1 & 3 root certificate from  https://www.cacert.org/index.php?id=3 as CA's.
                                    Then I added the Certificate I generated :

                                    • Method is : Import an Existing Certificate

                                    • Descriptive name : SSL Firewall certificate

                                    • Certificate data :```
                                      -----BEGIN CERTIFICATE REQUEST-----
                                      MIIEYzCCAksCAQAwHjEcMBoGA1UEAxMTcnV0aGVyLmEzLXN5c3RlbS5ldTCCAiIw
                                      DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL22lqy5GkaYOudPFljPax00GRUN
                                      BRZxINqUbu2QZekW0YW6I+I08RAAr5Ihq7bV5Hp31HCWV62oNVc+bk3wlHPpan8B
                                      HqiSXw3sFTw9007qlBtB/WdUJCMSg36WTj4iRBQE2kQnPN4FyBWVqQ68aclC8/5N
                                      WLwG5SIALaJ3QkTm89Jmce3JbH0fUsw7HlfkvGY3twtvoD4c9m7dzvIgXtqoKe0y
                                      XRKbd3Tnl9cF0ZKDtRI9WCwPsynhxnjX8GghES13exajutw12WwDp5cL82J2usdC
                                      SEWG5LTBbNTvJrdEr/PduZ4brVnOx0U+04zeGNfvBIvNfEB4APz+lkDuVczht2De
                                      YlL4DOjYHS7oqCcVuAUa25O5NUNKT/qThNFQfAaBnpc6FRV8I65SqnzkwTn+tbPW
                                      HQ6OvGYBBoWGRttI7chatCw+4VHmBqRf3vTRl6+bBcRfI5PxrB67UW4AfNaDXlu1
                                      5KGPHkO8l0kXJjRzjwB36Ho0MH9IXKUvYQbxdoJ9wntyV7NjvN8CJg0C6rORAcxN
                                      7Xp28MGwxEW6xEghCozj99KgNKwnlEn5ynDdLf/LfkIkpaheJ3p26MPMWeAtfICD
                                      XuJBVmwjn8mpHgq7d3AZIVF5vkLF9JvXqREA0UAiutuV/eFBVlBgUWHVvy2nMcDZ
                                      LOaIWk5rboaSvtwnAgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAgEADV5FG87uRAbS
                                      8XowLqudKRIqNkftoUO/U7nhHSWj1XNKXdp6Y5e3U7BiJxYuKiZ3AuttyCMdBZ17
                                      28w6Vc/qsIRIvB//Xglj4ZRFLL+CKQ9PGX/w9lgtN9pEUSzl7LpKF2luvmySzDcD
                                      rULmUqB2Q6qyYgzMALK7eFLqnEYxeAXM6bw/64mvOoqviVFgtvMG3mx5QHBj98RS
                                      tOidaqwowKwfk112FXjikn/EKD2P5JI5zWkhHXNjha7YGCcxy/LwaubH3VnCz6bg
                                      HNoB6r1rGPwxz4YnspVOkCSPHdSHJiGCpwurF9zm4zNMk3SwbWtDW14dVoIXInIU
                                      tzdXfiS2UVPsgNtX3OQzt3LqwS+WiSFShjLKB3EgFHKibml99Bj+Ep55ptuhOkQt
                                      PRLo68VZV7tq03xvB2/pzCovQp06Fme8sZJyS6xVY7ir+YAyLsm+nwsRNktkiHWu
                                      NigfJhf6irRxwHf3lLXYgzEBRV7rzuxO2UxFeuluePZoXMZ7V3+zSQU3iKrpt8gp
                                      2P6tZbgJ/E/aQUPqokGgLXuRbpK3ywwebDSrWcc1LQCkQbBQylhWdcmHKylzhPzt
                                      k+yW2KNP69rQ1oobsTYyz9mHBHs5iT5vCz24K5TiIsToTqotVJGqFqsmujnEqD9w
                                      KgmjwdBTCEdpOcSLMwOxBiVvQ1LQ3fc=
                                      -----END CERTIFICATE REQUEST-----

                                    *   Private key data :```
-----BEGIN RSA PRIVATE KEY-----
MIIJK ....
...
...MP5nAc/8IcadB9YQ7U91stzaDblm04iBr
-----END RSA PRIVATE KEY-----

                                    but when I select that certificate to be used the webConsole becomes inaccessible  :'(

                                    System log contains :

                                    Sep 22 22:10:39	php-fpm[77403]: /rc.restart_webgui: Creating rrd update script
Sep 22 22:10:39	php-fpm[77403]: /rc.restart_webgui: The command '/usr/local/sbin/lighttpd -f /var/etc/lighty-webConfigurator.conf' returned exit code '255', the output was '2015-09-22 22:10:39: (network.c.549) SSL: couldn't read X509 certificate from '/var/etc/cert.pem''
Sep 22 22:10:37	check_reload_status: webConfigurator restart in progress
Sep 22 22:10:37	php-fpm[14674]: /system_advanced_admin.php: webConfigurator configuration has changed. Restarting webConfigurator.
Sep 22 22:10:33	check_reload_status: Reloading filter

                                    Any idea what could be wrong … ?

                                    \T,

                                    1 Reply Last reply Reply Quote 0
                                    • KOMK
                                      KOM
                                      last edited by

                                      Maybe this?

                                      Sep 22 22:10:39 php-fpm[77403]: /rc.restart_webgui: The command '/usr/local/sbin/lighttpd -f /var/etc/lighty-webConfigurator.conf' returned exit code '255', the output was '2015-09-22 22:10:39: (network.c.549) SSL: couldn't read X509 certificate from '/var/etc/cert.pem''

                                      If it has a problem reading the file or the file is corrupt, that may trigger your issue.

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        You are trying to install a CSR (Certificate signing request) as a certificate.  You need to get the certificate issued to you and install that.

                                        –---BEGIN CERTIFICATE REQUEST-----

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          JohnnyBeGood
                                          last edited by

                                          @Derelict:

                                          No.  You installed your certificate as a CA.  You need to install the StartSSL Class 1 Intermediate Server certificate as a CA.  Delete the Web gui linux from CAs and install this.

                                          http://www.startssl.com/certs/sub.class1.server.ca.pem

                                          –---BEGIN CERTIFICATE-----
                                          MIIF2TCCA8GgAwIBAgIHFxU9nqs/vzANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQG
                                          EwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERp
                                          Z2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2Vy
                                          dGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDcxMDE0MjA1NDE3WhcNMjIxMDE0MjA1
                                          NDE3WjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzAp
                                          BgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV
                                          BAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgU2VydmVy
                                          IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtonGrO8JUngHrJJj
                                          0PREGBiEgFYfka7hh/oyULTTRwbw5gdfcA4Q9x3AzhA2NIVaD5Ksg8asWFI/ujjo
                                          /OenJOJApgh2wJJuniptTT9uYSAK21ne0n1jsz5G/vohURjXzTCm7QduO3CHtPn6
                                          6+6CPAVvkvek3AowHpNz/gfK11+AnSJYUq4G2ouHI2mw5CrY6oPSvfNx23BaKA+v
                                          WjhwRRI/ME3NO68X5Q/LoKldSKqxYVDLNM08XMML6BDAjJvwAwNi/rJsPnIO7hxD
                                          KslIDlc5xDEhyBDBLIf+VJVSH1I8MRKbf+fAoKVZ1eKPPvDVqOHXcDGpxLPPr21T
                                          Lwb0pwIDAQABo4IBTDCCAUgwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E
                                          BAMCAQYwHQYDVR0OBBYEFOtCNNCYsKuf9BtrCPfMZC7vDixFMB8GA1UdIwQYMBaA
                                          FE4L7xqkQFulF2mHMMo0aEPQQa7yMGkGCCsGAQUFBwEBBF0wWzAnBggrBgEFBQcw
                                          AYYbaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL2NhMDAGCCsGAQUFBzAChiRodHRw
                                          Oi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwMgYDVR0fBCswKTAnoCWg
                                          I4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMEMGA1UdIAQ8MDow
                                          OAYEVR0gADAwMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9w
                                          b2xpY3kucGRmMA0GCSqGSIb3DQEBCwUAA4ICAQCBnsOw7dxamNbdJb/ydkh4Qb6E
                                          qgEU+G9hCCIGXwhWRZMYczNJMrpVvyLq5mNOmrFPC7bJrqYV+vEOYHNXrzthLyOG
                                          FFOVQe2cxbmQecFOvbkWVlYAIaTG42sHKVi+RFsG2jRNZcFhHnsFnLPMyE6148lZ
                                          wVdZGsxZvpeHReNUpW0jh7uq90sShFzHs4f7wJ5XmiHOL7fZbnFV6uE/OoFnBWif
                                          CRnd9+RE3uCospESPCRPdbG+Q4GQ+MBS1moXDTRB6DcNoHvqC6eU3r8/Fn/DeA9w
                                          9JHPXUfrAhZYKyOQUIqcfE5bvssaY+oODVxji6BMk8VSVHsJ4FSC1/7Pkt/UPoQp
                                          FVh38wIJnvEUeNVmVl3HHFYTd50irdKYPBC63qi2V/YYI6bJKmbrjfP9Vhyt9uNr
                                          y3Kh4W22ktDuCCvWC7n/gqerdq+VlTRfNt7D/mB0irnaKjEVNCXBXm9V/978J+Ez
                                          8aplGZccQ9jnc9kiPtUp5dj45E3V8vKqzp9srSSI5Xapdg+ZcPY+6HNuVB+MadRp
                                          ZW2One/Qnzg9B4GnVX7MOETImdoP4kXpostFuxoY/5LxCU1LJAIENV4txvT50lX2
                                          GBXCkxllRLWOgdyll11ift/4IO1aCOGDijGIfh498YisM1LGxytmGcxvbJERVri+
                                          gGpWAZ5J6dvtf0s+bA==
                                          -----END CERTIFICATE-----

                                          After that, when you look at your certificate, it should show as being issued by that cert (Issuer)…

                                          DISCLAMER: I'm not trying to be an asshole or anything like that!

                                          I really appreciate your response but yet again using your instructions I got locked out. Can you or someone else explain (screenshot if possible) steps taken to get this working. I've tried so many explanations online and they all worked but this simple one seems such a road block! Call me dumb but I do not get where the problem is.

                                          I promise once I get it to work I will create a video tutorial so anyone can get it to work without any lock outs.

                                          I like to fill my tub up with water, then turn the shower on and act like I'm in a submarine that's been hit!

                                          1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan
                                            last edited by

                                            Here https://forum.pfsense.org/index.php?topic=63791.0 - last message, you will find a PDF with a lot of images.

                                            The PDF talks about adding a certificate for captive Portal access, but, I used it to add a certificate for WebGUI access.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.