23.01 -> 23.05 upgrade failed

demux

This is the result of 23.01 -> 23.05:

Updating repositories metadata...
Updating pfSense-core repository catalogue...
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
34942771200:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_05-main/sources/FreeBSD-src-plus-RELENG_23_05/crypto/openssl/ssl/statem/statem_clnt.c:1921:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
34942771200:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_05-main/sources/FreeBSD-src-plus-RELENG_23_05/crypto/openssl/ssl/statem/statem_clnt.c:1921:
...
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg00.atx.netgate.com
34942771200:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-23_05-main/sources/FreeBSD-src-plus-RELENG_23_05/crypto/openssl/ssl/statem/statem_clnt.c:1921:
pkg-static: https://pfsense-plus-pkg00.atx.netgate.com/pfSense_plus-v23_05_amd64-pfSense_plus_v23_05/packagesite.txz: Authentication error
Unable to update repository pfSense
Error updating repositories!
ERROR: It was not possible to determine pfSense-upgrade remote version
ERROR: It was not possible to determine pfSense-upgrade remote version
Upgrading pfSense-upgrade... failed.

And then it says that 23.01 is latest version.

Raffi_

I had the same issue with upgrade error through GUI and then the GUI showing I already have the latest install. I was able to solve this by SSHing into console and using "pfsense-upgrade".

Make sure you backup your current setup first.
Do not upgrade packages.
If you upgraded packages before performing the pfsense upgrade, you may have to do a completely fresh install. Been burned by that once and it was enough to learn the lesson. Thankfully, I had backups and was back up and running pretty quick!

jrey

@demux

and then if you set it back to previous (23.01) and let it sit a moment, then change it back to 23.05 it will offer the update again. I haven't retried it at this point, as other more important things on the table today.

However, the certificate issue, doesn't seem like a "me" problem, and hopefully next time a try the update, it will have been resolved by the official release.

In the meantime I did reach out to TAC to get the firmware download. So that's an entirely different set of issues for another day if needed. Like finding a console to hook up etc.

Better would be if the update just worked. So far nothing lost nothing changed running 23.01 as if nothing happened, and the update still showing.

demux

Thanks a lot.
I will wait until someone from Netgate says "fixed".
I don't want want to set it up again. It has i226 ports and it was a small horror to bring it to 23.01. I don't want to mess that.

mark_lab_user

Got the upgrade failed on first try. Then went back to Previous Stable Version 23.01 on the System/Update/System Update Gui page. and then rebooted.

Then 2nd try succeeded. Don't know why.

But now my Wireguard Tunnel and Peer to a privacy VPN is gone. The package, interface and WAN and LAN firewall rules exist for the VPN though.

I restored the XML backup file which does contain the correct wireguard keys and endpoint address so I don't know what to do next.

demux

@mark_lab_user I saw there is an update to the wireguard package. May it's for 23.01 only.

jrey

@demux

Just FYI, I completed the update this morning. No issues. So the certificate issue yesterday was simply the device was ready to update, the servers where not. -- So all good here.

demux

I normally update packages when I see that they are available. I read multiple times that you should not update packages before system update to a new release. Why? What can happen? I try to have an up-to-date system all the time, does that mean that I should/can never update the system?

Gertjan

@demux said in 23.01 -> 23.05 upgrade failed:

Why?

Example :

A pfSense GUI package uses PHP. PHP, among version, will be nearly identical, but new functionality can get added, old functionality can have been removed.
PHP is an interpreted language, so what if the updated package uses new functionality, available only in the the newer PHP version ?
The newly available pfSense package will 'depend' on the new PHP version, not installed on pfSense. So, it will also get pull in (== installed) this new PHP version ... overwriting the older, exiting PHP version.
Now you just broke the entire GUI ...

Another example :

Software is written with an OS version in mind.
Most system functions like 'open a file' and 'close a file' is functionality exposed by the system as system libraries.
Newer software needs newer library version.
So, when the package, not only a pfSense GUI package but also 'core' (executable) packages depend on newer libraries, these will get installed also.
Overwriting system core libraries
Now the entire system is broken.

Most complex, and easy to understand example :
I'll exaggerate : would you install Windows XP software on a Windows 11 version ?
Noop. If you need software that needs Windows 11, you first install Windows 11, and then you install your software.

To get more examples :
In stead of using the GUI, next time, use the console or (better) SSH access.
Use option 13.

This will list things to be updated, if any.
And if it does, it will list what it updates, and if it depends on something, it will also get these.
Most often, there isn't much to do.
But if you see (example) that the latest pfSense package X upgrade also upgrade system packages like PHP, you better think twice before you hit the 'Y' key to proceed with the upgrade.

World's most know actual show case :
I see this on my PC right now :

and I have also a rather big Office365 update/upgrade waiting for this PC, as it adds (probably ?) Windows 11 support, amongst others.

What will I do ?

Easy.
I wait before I install Windows 11 ("let it mature first") as this concerns an PC I use on my work, and it works pretty well up until now.
When it's time, I'll upgrade to Windows 11 - and only then I'll upgrade other apps.

Also :
pfSense has ZFS support with the recent versions.
So, you can crate a snap shot of your current pfSense version.
When done, select this snap shot and boot it.
Now, install the new pfSense version.
Then upgrade the packages - actually : you have nothing to do, as, when you upgrade pfSense, all packages get also re installed == to their latest version)

Test everything.

If there is the slights issue you can't resolve right away, you can boot the previous snap shot and you'll be back with a working pfSense.

Lasts words : package upgrade add functionality.
If the update concerns a security issue, you will find forum / blog posts about the issue, and you will find instructions about how to proceed.

demux

@Gertjan Thanks a lot.
In other words:
The packages that are shown are not associated or tied to the pfSense version currently running. New package versions shown may "belong" to the newer version of pfSense, and that means "think twice before updating packages if not running the most recent version of pfSense". Correct?
I always thought they are tied via some sort of version specific repository like in Debian or whatever.

Gertjan

@demux said in 23.01 -> 23.05 upgrade failed:

The packages that are shown are not associated or tied to the pfSense version currently running.

Probably not ;)
You could update them right now .... before upgrading pfSense first.
You will be violating pfSense usage rules, though.
See the "what t do when an pfSese updgarde is aviable" : Netgate Blog post, upgrade documentation ( ! ), user experience here on the forum. etc.

@demux said in 23.01 -> 23.05 upgrade failed:

New package versions shown may "belong" to the newer version of pfSense, and that means "think twice before updating packages if not running the most recent version of pfSense". Correct?

Correct.

@demux said in 23.01 -> 23.05 upgrade failed:

I always thought they are tied via some sort of version specific repository like in Debian or whatever.

Aha : the good question
This is my (private) answer : as soon as Netgate becomes a "Fortune 500" company, they will be able to manage a package repository for every available (supported) version they bring out.
So, example, when you use pfSense+ 23.01, the pfSense package list will show you only the packages available for that "23.01" version and not the other ones.

You should know that not every pfSense packages is written and maintained by Netgate. Some are maintained by other people, like you and me.

Now, tell me, would you want to maintain your package for pfSense 2.4.5, 2.5.2, 2.6.0, 22.01, 23.01, 23.05 and several intermediate snap shot versions (so users can try out the newer versions with you before they will get released for he big public ) ?
Most probably : you don't, you'll maintain against the latest pfSense stable version only, as you don't want to be bothered with bugs from an ancient 2.4.5 version.

You mentioned 'Debian' :

deb http://security.debian.org/ buster/updates main contrib non-free
deb-src http://security.debian.org/ buster/updates main contrib non-free

so I use the 'buster' repository, (Debian 10) not the version '11' Bullseye.

Debian uses a dedicated repository for every main version release.

pdavis

@pdavis Update - After toggling the "Current Stable Version" and "Previous Stable Version" in System/Update/System Update, the GUI now showed 23.05 upgrade option.

Upgrade processed without incident this time - it looks like it just appeared as an option in the GUI a day or so before the server side was ready.

driise

I had an upgrade issue on my VM instance, flipping the branch between 23.01 and 23.05 resolved it and running update the second time worked. No such love on my physical install (Dell R210II). All attempts from GUI fail, so started trying via CLI.

I have tried a few iterations. After this issue, I flip the branch back to 23.01 and run "pkg-static clean -ay ; pkg-static install -fy pkg pfSense-repo pfSense-upgrade" which seems to get it back into a "good" state.

[23.01-RELEASE][admin@NONO]/root: cat /usr/local/etc/pkg.conf
ABI=FreeBSD:14:amd64
ALTABI=freebsd:14:x86:64
[23.01-RELEASE][admin@NONO]/root: pfSense-upgrade -c
>>> Setting vital flag on pfSense-upgrade... done.
ERROR: It was not possible to determine pkg remote version
>>> Updating repositories metadata... ^[[A^[[Adone.
Your system is up to date
[23.01-RELEASE][admin@NONO]/root: cat /usr/local/etc/pkg.conf
ABI=FreeBSD:14:amd64
ALTABI=freebsd:14:x86:64
PKG_ENV {
	SSL_CA_CERT_FILE=/etc/ssl/netgate-ca.pem
	SSL_CLIENT_CERT_FILE=/usr/local/etc/pfSense/pkg/repos/pfSense-repo-prev-cert.pem
	SSL_CLIENT_KEY_FILE=/usr/local/etc/pfSense/pkg/repos/pfSense-repo-prev-key.pem
}

*** changed Branch setting in GUI to 23.05 ***

[23.01-RELEASE][admin@NONO]/root: cat /usr/local/etc/pkg.conf
ABI=FreeBSD:14:amd64
ALTABI=freebsd:14:x86:64
PKG_ENV {
	SSL_CA_CERT_FILE=/etc/ssl/netgate-ca.pem
	SSL_CLIENT_CERT_FILE=/usr/local/etc/pfSense/pkg/repos/pfSense-repo-stable-cert.pem
	SSL_CLIENT_KEY_FILE=/usr/local/etc/pfSense/pkg/repos/pfSense-repo-stable-key.pem
}
[23.01-RELEASE][admin@NONO]/root: pfSense-upgrade -c
>>> Updating repositories metadata... done.
23.05 version of pfSense is available
[23.01-RELEASE][admin@NONO]/root: pfSense-upgrade -d
>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: . done
Processing entries: .. done
pfSense-core repository update completed. 15 packages processed.
Updating pfSense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: .......... done
Processing entries:
Processing entries............. done
pfSense repository update completed. 549 packages processed.
All repositories are up to date.
>>> Upgrading pfSense-upgrade...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
	pfSense-upgrade: 1.0_61 -> 1.0_66 [pfSense]

Number of packages to be upgraded: 1

20 KiB to be downloaded.
[1/1] Fetching pfSense-upgrade-1.0_66.pkg: ... done
Checking integrity... done (0 conflicting)
[1/1] Upgrading pfSense-upgrade from 1.0_61 to 1.0_66...
[1/1] Extracting pfSense-upgrade-1.0_66: ...... done
pfSense-repoc-static: invalid signature
failed to read the repo data.
failed to update the repository settings!!!
failed to update the repository settings!!!

PhlMike

This post is deleted!

DaddyGo

@Raffi_ said in 23.01 -> 23.05 upgrade failed:

I had the same issue with upgrade error through GUI and then the GUI showing I already have the latest install. I was able to solve this by SSHing into console and using "pfsense-upgrade".

Hi Bro, it was the same here ,
I subscribed to this thread and I see you have been here, hope all is well with you, long time no hear from you...

BTW:
SSH solves everything, hahaha

Raffi_

@DaddyGo said in 23.01 -> 23.05 upgrade failed:

@Raffi_ said in 23.01 -> 23.05 upgrade failed:

I had the same issue with upgrade error through GUI and then the GUI showing I already have the latest install. I was able to solve this by SSHing into console and using "pfsense-upgrade".

Hi Bro, it was the same here ,
I subscribed to this thread and I see you have been here, hope all is well with you, long time no hear from you...

all is good my friend. Been enjoying the nice west coast weather. Hope all is good with you.

BTW:
SSH solves everything, hahaha

haha we are such nerds because we find that funny.

DaddyGo

@Raffi_ said in 23.01 -> 23.05 upgrade failed:

Been enjoying the nice west coast weather. Hope all is good with you.

That's nice, hmmm the ocean is a little warmer at Lisbon - that's why I'm not complaining...:)

Now everything is OK, I had a little health problem, but it's sorting itself out. I've been away from "here" because of that, but now I'll have time and we'll push SSH hard

BTW:
I'll have time to do a bit better with this great NGFW, the "love" has remained

SteveITS

@Gertjan said in 23.01 -> 23.05 upgrade failed:

when you use pfSense+ 23.01, the pfSense package list will show you only the packages available for that "23.01" version and not the other ones.

Actually, that is not correct. It will show packages for the selected branch, which may not be the installed version if this router has not yet upgraded to the latest version, but has Current selected.

In the past one could install/upgrade a package in that state, and the package would pull in software, maybe a later PHP version, and break everything. However I think I did see they are showing a warning now about the version/repo mismatch? I would still select Previous Stable Version if necessary to make them match. There is a redmine about this.

Innz

Is this common for pfsense? I have a 6100 and 4100. Went to update both and now both of them will not load the gui? I have only had them long enough to update the software twice (this being the second time). Worse firewall I have ever used in my life when try to update.

DaddyGo

@Innz said in 23.01 -> 23.05 upgrade failed:

Worse firewall I have ever used in my life when try to update.

Hmmmm

@Innz "Is this common for pfsense?"

No it's not general, don't assume anything at first.
Always make a backup and you can restore it in no time if you're experienced.