Upload SSL certificate for webconfigurator via ssh/scp
I use a seperate server that handles all my LetsEncrypt certificate renewals, this gives me a central secure location to create and renew certificates (all renewals are done via DNS-01, so the renewal server is not accessible from outside), these are then uploaded via ssh to various servers and then apache/nginx/postfix etc is restarted on the remote systems.
I can not find where pfsense stores the certificate used for the web frontend
My normal way of renewing a certificate is :
SSL Management server :-
certbot /renew scp email@example.com /etc/letsencrypt/live/remote.server.one/fullchain.pem /etc/ssl/ scp firstname.lastname@example.org /etc/letsencrypt/live/remote.server.one/private.pem /etc/ssl/ ssh email@example.com /usr/sbin/service nginx reload
I know nginx uses /var/etc/cert.crt/key and that some form of the certificate is stored in /cf/conf/config.xml but i can't work out how to push a new certificate in the correct format (and where that certificate should be pushed to so it is loaded after restart of webconfig or a full system restart)
Can anyone point me in the right direction? Also how can you reload the web frontend from the command prompt (non interactively)?
As I already have my ssl management server setup, I don’t want to use the letsencrypt acme package on pfsense itself and I want to use the same system to push certificates to multiple pfsense servers.
Any tips/suggestions would be welcome.
Gertjan last edited by
The acme package uses this command (shell script) to reload the NGINX web servers after a new cert was imported.
The acme package also contains the scripts that can show you how to import the certs into pfSense config.