Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    repo01.netgate.com TLS cert seems invalid

    Scheduled Pinned Locked Moved
    Official Netgate® Hardware
    9
    43
    8.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      seanmcb @stephenw10
      last edited by

      @stephenw10 said in repo01.netgate.com TLS cert seems invalid:

      It's because that repo is authenticated. It expects the client to send a cert and your browser does not. Neither does ssllabs

      Ah, thanks for the actual explanation. Much appreciated.

      I'll have access to the device again in about 10 hours and can try from the shell the steps you asked about.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Let us know if you're still seeing that.

        S 1 Reply Last reply Reply Quote 0
        • S
          seanmcb @stephenw10
          last edited by

          @stephenw10 my output is quite like yours:

          [21.05-RELEASE][admin@pfSense.localdomain]/root: pkg -d update
DBG(1)[42611]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[42611]> PkgRepo: verifying update for pfSense-core
DBG(1)[42611]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[42611]> Request to fetch pkg+https://repo.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-core/meta.conf
DBG(1)[42611]> opening libfetch fetcher
DBG(1)[42611]> Fetch > libfetch: connecting
DBG(1)[42611]> Fetch: fetching from: https://repo01.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-core/meta.conf with opts "i"
DBG(1)[42611]> Fetch: fetcher chosen: https
DBG(1)[42611]> Request to fetch pkg+https://repo.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-core/packagesite.txz
DBG(1)[42611]> opening libfetch fetcher
DBG(1)[42611]> Fetch > libfetch: connecting
DBG(1)[42611]> Fetch: fetching from: https://repo01.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-core/packagesite.txz with opts "i"
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
DBG(1)[42611]> PkgRepo: verifying update for pfSense
DBG(1)[42611]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense.sqlite'
DBG(1)[42611]> Request to fetch pkg+https://repo.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-pfSense_plus-v21_05_1/meta.conf
DBG(1)[42611]> opening libfetch fetcher
DBG(1)[42611]> Fetch > libfetch: connecting
DBG(1)[42611]> Fetch: fetching from: https://repo01.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-pfSense_plus-v21_05_1/meta.conf with opts "i"
DBG(1)[42611]> Fetch: fetcher chosen: https
Fetching meta.conf: 100%    163 B   0.2kB/s    00:01    
DBG(1)[42611]> Request to fetch pkg+https://repo.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-pfSense_plus-v21_05_1/packagesite.txz
DBG(1)[42611]> opening libfetch fetcher
DBG(1)[42611]> Fetch > libfetch: connecting
DBG(1)[42611]> Fetch: fetching from: https://repo01.netgate.com/pkg/pfSense_plus-v21_05_1_aarch64-pfSense_plus-v21_05_1/packagesite.txz with opts "i"
DBG(1)[42611]> Fetch: fetcher chosen: https
Fetching packagesite.txz: 100%  129 KiB 131.8kB/s    00:01    
DBG(1)[42611]> PkgRepo: extracting packagesite.yaml of repo pfSense
DBG(1)[43042]> PkgRepo: extracting signature of repo in a sandbox
DBG(1)[42611]> Pkgrepo, reading new packagesite.yaml for '/var/db/pkg/repo-pfSense.sqlite'
Processing entries: 100%
pfSense repository update completed. 464 packages processed.
All repositories are up to date.

          Biggest difference is repo00.netgate.com vs repo01.netgate.com and mine has additional output Fetch: fetcher chosen: https.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            repo00 and repo01 should be identical there, that shouldn't matter.

            S 1 Reply Last reply Reply Quote 0
            • S
              seanmcb @stephenw10
              last edited by

              @stephenw10 so do you think the part about Fetch: fetcher chosen: https is the difference that explains the failure I see?

              I could always try a magic reboot, but I'm not in a huge rush to update. If there's something more we can troubleshoot to find this bug, I'm game.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                @seanmcb said in repo01.netgate.com TLS cert seems invalid:

                Processing entries: 100%
                pfSense repository update completed. 464 packages processed.
                All repositories are up to date.

                It looks to be updating from the repo successfully. What failure are you seeing?

                My output also shows it choosing https, I don't think that's an issue.

                Steve

                S 1 Reply Last reply Reply Quote 0
                • S
                  seanmcb @stephenw10
                  last edited by

                  @stephenw10 the failure I'm seeing is as per my first message in this thread. The update fails with the error message text I pasted.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Hmm, OK try running at the command line: pfSense-upgrade -d

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      seanmcb @stephenw10
                      last edited by

                      @stephenw10 said in repo01.netgate.com TLS cert seems invalid:

                      pfSense-upgrade -d

                      [21.05-RELEASE][admin@pfSense.localdomain]/root: pfSense-upgrade -d
>>> Updating repositories metadata... 
Updating pfSense-core repository catalogue...
Fetching meta.conf: . done
1082880000:error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib:/usr/local/poudriere/jails/pfSense_plus-v21_05_aarch64/usr/src/crypto/openssl/ssl/statem/statem_lib.c:283:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/CN=repo01.netgate.com
1082880000:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:/usr/local/poudriere/jails/pfSense_plus-v21_05_aarch64/usr/src/crypto/openssl/crypto/asn1/a_verify.c:170:
1082880000:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/local/poudriere/jails/pfSense_plus-v21_05_aarch64/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Child process pid=62247 terminated abnormally: Segmentation fault
                      M 1 Reply Last reply Reply Quote 0
                      • M
                        mer @seanmcb
                        last edited by mer

                        @seanmcb What hardware are you doing this on? My reason for asking is I had a very similar issue on a SG2100 (symptom of segfault was the same). Power cycling (not rebooting) cleared the issue. Literally, shutdown the system, removed power for at least 30 secs, then reapplied power. Issue went away. Suspect that openssl is using crypto hardware that can get wedged and the only cure is power cycle.

                        I have no opinion on the validity of the certificate.

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          seanmcb @mer
                          last edited by

                          @mer My hardware is a Netgate SG-1100.

                          I could try a power cycle, but I'm not in a big rush to update, and this bug is reproducible for the moment, so it's a chance to debug it, and maybe solve it.

                          M 1 Reply Last reply Reply Quote 1
                          • M
                            mer @seanmcb
                            last edited by

                            @seanmcb That's good, but my point is that if the root cause is the hardware itself getting wedged, there's not much debugging that can actually be done. Hopefully the netgate folks may have some commands that would say "yep hardware is wedged, can't get more info".

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Hmm, so it hits that when you try to upgrade but 'pkg-static update' completes successfully?

                              That's odd. I would expect both to fail.

                              With that error on an SG-1100 though it's almost certainly the crypto hardware issue. If you power cycle it and it then succeeds that would confirm it.

                              Steve

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                seanmcb @stephenw10
                                last edited by

                                @stephenw10 said in repo01.netgate.com TLS cert seems invalid:

                                Hmm, so it hits that when you try to upgrade but 'pkg-static update' completes successfully?

                                pkg-static update has not been mentioned in this thread. I did not try it. So far I tried to update in the GUI and with pfSense-upgrade -d. Both have failed.

                                With that error on an SG-1100 though it's almost certainly the crypto hardware issue. If you power cycle it and it then succeeds that would confirm it.

                                I'll reboot it when home tonight.

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Mmm, my bad. But pkg -d update succeeded. You might try pkg-static -d update too just for reference before you reboot,

                                  Steve

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    seanmcb @stephenw10
                                    last edited by

                                    After a magic reboot, updating from the GUI failed again, but pkg-static -d update worked.

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Hmm, OK. What about pfSense-upgrade -d at the command line?

                                      S 1 Reply Last reply Reply Quote 0
                                      • S
                                        seanmcb @stephenw10
                                        last edited by

                                        @stephenw10 That would have been my 3rd try, but after reboot I tried: GUI, then pkg-static -d update and the latter worked. Is there point in still running the other command?

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          The update commands just update the package database. The upgrade command will actually try to upgrade to 21.05.1.

                                          Steve

                                          S 1 Reply Last reply Reply Quote 0
                                          • S
                                            seanmcb @stephenw10
                                            last edited by

                                            @stephenw10 mmmm, you sure? Because after:

                                            • magic reboot
                                            • pkg-static -d update
                                            • requisitie reboot

                                            The GUI shows me at 21.05.1 and says 'no updates available'.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post