certificate error while running pkg update

[hcww]

hi all

i have pfsense 2.4.5_1 and today while updating packges it gives me the following certificate errors

pfsense error.txt

[Yamabushi]

Yep, not just you. I'm experiencing the same issue.

[Apsis-IM]

Same.

[elite_kzm]

Add me to the list. Was working earlier today, then stopped working for me this evening. I initially suspected it may have been related to some changes I made to DNS Resolver configuration, but after spending an hour or so tearing my hair out and trying various potential fixes I found online, I stumbled on this thread. Getting the exact same error when I try running /usr/local/sbin/pkg-static update -f per this page.

[fjsantos]

Me too:

Updating pfSense-core repository catalogue...
Certificate verification failed for /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
34406329672:error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed:/build/ce-crossbuild-245/sources/FreeBSD-src/crypto/openssl/ssl/s3_clnt.c:1269:

blablabla

[AB5G]

Same for me

Updating repositories metadata...
pkg-static: Warning: Major OS version upgrade detected. Running "pkg bootstrap -f" recommended
Updating pfSense-core repository catalogue...
Certificate verification failed for /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

[Apsis-IM]

I'm pretty new to pfsense and BSD in general. I went wild with fixes all over this board, Reddit, and random google search results. It appears this has happened before (May 2020). The netgate team had to update certs on the webserver.

[Yamabushi]

@apsis-im
Yep, I think you are correct.

[JRubenC]

+1

Not working either on a new install I was performing this Saturday.

Interestingly, both https://files00.netgate.com/ and https://files01.netgate.com/ have a valid certificate:

*  subject: OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.netgate.com
*  start date: Mar 13 00:00:00 2019 GMT
*  expire date: Apr 11 23:59:59 2021 GMT

so clearly is something deeper in their setup... I guess we have to wait.

[castigo86]

Yeah, same for me on pgk upgrade && pkg update.

Certificate verification failed for /C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root

Let's wait and see

[monofox]

+1

Can confirm this on latest stable pfSense factory. This does still happen after removing AddTrust CA from /usr/local/share/certs/ca-root-nss.crt (may we need to reboot?)

curl, openssl, etc. is choosing the correct certification path. fetch / pkg on freebsd seems to choose a different way for certification verification? Normally it should automatically ignore the AddTrust also its send from server and divert to system path and to go one of those two ways:
login-to-view

If i see it correctly, #1 must be possible for pfSense, as USERTrust RSA Certification Authority seems in system store.

Temporarily for urgent matter, it is strongly not recommended, but possible by disabling certification peer check via env SSL_NO_VERIFY_PEER=1 pkg update

[Alex89]

Same here.. Thought it was an error on my side until i found this thread..
I guess we have to wait for the Team to fix that..?

[castigo86]

Did anyone post a bug report?

[provels]

@castigo86
I wouldn't worry too much. Mods will see in forum.

[JRubenC]

@provels said in certificate error while running pkg update:

@castigo86
I wouldn't worry too much. Mods will see in forum.

Yeah. But it's a bit embarrasing that for everybody out there running pfsense systems, we're now stuck without being able to install new packages just because someone somewhere hasn't a proper monitoring of something and someone somewhere has to wake up on this Saturday, check the forums, see the 2 threads about it, think "shit!" and fix it.

[ddave]

any options to install from command line? Trying to setup the OpenVPN Export wizard.

[revengineer]

Same issue here.

[Zak 0]

Same, joined to post a question to get help, will get fixed when it's fixed.

[nolaquen]

Had the issue all morning, but it's back up and working for me now.

[castigo86]

Yap, I can confirm it's working for me too now.