I'm an idiot

bcole8888

I wanted to create an SSL cert on my pfsense box so my browser would trust the webgui. I created an internal CA, an certificate, turned on https for the webgui. But now neither Chrome nor IE, or Edge will let me login. I get this in Chrome:

_10.1.1.254 normally uses encryption to protect your information. When Google Chrome tried to connect to 10.1.1.254 this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be 10.1.1.254, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged.

You cannot visit 10.1.1.254 right now because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later._

Is there anything I can do short of rebuilding pfSense?

dreamslacker

Go to the console interface.

Select "Set interface(s) IP addresses".
Select "LAN".
Set the IP to the same address as you are using.
When prompted, choose not to use HTTPS.

You should be able to access the WebGUI after that.

jimp

Or from a shell prompt, run:

pfSsh.php playback generateguicert

That will create a new self-signed certificate and activate it.

istacey

This post is deleted!

Gertjan

@bcole8888 said in I'm an idiot:

I wanted to create an SSL cert on my pfsense box so my browser would trust the webgui. I created an internal CA, an certificate, turned on https for the webgui. But now neither Chrome nor IE, or Edge will let me login. I get this in Chrome:

Keep in mind : browser do not trust any web server certificate. So Chrome, Edge, IE (serious ?) and Firefox will always bail out.
But, they also have a list - on your device - with exceptions.

Typically, this list contains 'base' or 'parent' certificates from the big corporations like Verisign, etc etc.

When you create your own CA on pfSense, and derive a certificate from it, to be used for the https access of the GUI, you should not forget to add these to the list on your device. Now your browser will accept the certificate proposed by the GUI of Netgate.

NollipfSense

@bcole8888 For some positive vibes, since you're using pfSense, you're NOT an idiot.

johnpoz

You guys notice this thread is from 2017 ;) heheh spammer hit it and linked to some shit site.. Im going to lock it.