Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WAN requiring root CA to be installed for internet access

    General pfSense Questions
    certificate community
    5
    21
    1.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      You may have to add the proxy explicitly to allow that to work:
      https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#proxy-support

      Try running pkg-static -d update to get more error output though.

      R 1 Reply Last reply Reply Quote 0
      • R
        reqman @stephenw10
        last edited by

        @stephenw10 said in WAN requiring root CA to be installed for internet access:

        You may have to add the proxy explicitly to allow that to work:
        https://docs.netgate.com/pfsense/en/latest/config/advanced-misc.html#proxy-support

        Hmm, use it to support the normal update mechanism I suppose, right? I could try that I suppose, but I'd rather do the update manually via ISO, if that is possible.

        Try running pkg-static -d update to get more error output though.

        Sure:

        DBG(1)[27251]> pkg initialized
Updating pfSense-core repository catalogue...
DBG(1)[27251]> PkgRepo: verifying update for pfSense-core
DBG(1)[27251]> PkgRepo: need forced update of pfSense-core
DBG(1)[27251]> Pkgrepo, begin update of '/var/db/pkg/repo-pfSense-core.sqlite'
DBG(1)[27251]> Request to fetch pkg+https://pkg.pfsense.org/pfSense_v2_7_0_amd64-core/meta.conf
DBG(1)[27251]> opening libfetch fetcher
DBG(1)[27251]> Fetch > libfetch: connecting
DBG(1)[27251]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.conf with opts "i"
Certificate verification failed for /DC=local/DC=gov/DC=xxx/CN=xxx-SPECIAL-SubCA
34372419584:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-RELENG_2_7_0/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[27251]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.conf with opts "i"
Certificate verification failed for /DC=local/DC=gov/DC=xxx/CN=xxx-SPECIAL-SubCA
34372419584:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-RELENG_2_7_0/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[27251]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.conf with opts "i"
Certificate verification failed for /DC=local/DC=gov/DC=xxx/CN=xxx-SPECIAL-SubCA
34372419584:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-RELENG_2_7_0/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[27251]> Request to fetch pkg+https://pkg.pfsense.org/pfSense_v2_7_0_amd64-core/meta.txz
DBG(1)[27251]> opening libfetch fetcher
DBG(1)[27251]> Fetch > libfetch: connecting
DBG(1)[27251]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz with opts "i"
Certificate verification failed for /DC=local/DC=gov/DC=xxx/CN=xxx-SPECIAL-SubCA
34372419584:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-RELENG_2_7_0/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[27251]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz with opts "i"
Certificate verification failed for /DC=local/DC=gov/DC=xxx/CN=xxx-SPECIAL-SubCA
34372419584:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-RELENG_2_7_0/crypto/openssl/ssl/statem/statem_clnt.c:1921:
DBG(1)[27251]> Fetch: fetching from: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz with opts "i"
Certificate verification failed for /DC=local/DC=gov/DC=xxx/CN=xxx-SPECIAL-SubCA
34372419584:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-RELENG_2_7_0/crypto/openssl/ssl/statem/statem_clnt.c:1921:
pkg-static: https://pkg00-atx.netgate.com/pfSense_v2_7_0_amd64-core/meta.txz: Authentication error
        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Hmm, it would interesting to see what the cert the proxy is sending shows as when pfSense tries to access it.

          But just reinstalling 2.7.1 will work fine as long as you don't need to install pkgs.

          R 1 Reply Last reply Reply Quote 0
          • R
            reqman @stephenw10
            last edited by

            @stephenw10 my apologies for delaying to reply, suffering from the not-having-enough-free-time syndrome.

            Which would be the safest way to upgrade my installation to 2.7.1? Fresh install from ISO and import saved config? Have an ISO mounted and launch a script of some sort? Other?

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @reqman
              last edited by

              @reqman said in WAN requiring root CA to be installed for internet access:

              Have an ISO mounted and launch a script of some sort?

              If your pfSense is a VM, yes.
              Reboot the pfSense VM machine, and is should boot from the ISO? where the pfSense installer takes over.
              Another classic one : No VM, so prepare a USB drive. See pfSense documentation about how to create one. Use "etcher" as told.
              Boot from the USB drive : the installer takes over etc.

              If the installer finds an already extiing partion with the (old) 2.6.0) installed, it will use the config for the new setup.
              If not, no issue neither, just use your daily backup of the config file.
              Just finish the install with a minimal setup like : define LAN and WAN. Now the GUI is available from LAN. Login, and in the GUI, import the config. Have it reboot.
              Done.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              R 1 Reply Last reply Reply Quote 1
              • M mt_onsemi referenced this topic on
              • R
                reqman @Gertjan
                last edited by reqman

                @Gertjan took me almost a year to schedule some downtime for this device. Downloaded the compressed ISO of 2.7.2 (iso filename is netgate-installer-v1.0-RC-amd64-20240919-1435), mounted it to my pfsense 2.6 CE VM, enabled booting from the VM CD and fired it up. For a moment I did not understand that 2.7,2 actually booted TBH, until I noticed the "+" next to the pfsense logo :) . Did not know what to select at boot so I just let it take its path.

                Unfortunately, a bit later the VM shutted down by itself. Tried the exact same procedure, but no go.

                FYI host is a free ESX 5.5 hypervisor on an Xeon E5506 (yes, I know it's old).

                Seems I'll be stuck with 2.6.0 :)

                GertjanG bmeeksB 2 Replies Last reply Reply Quote 0
                • GertjanG
                  Gertjan @reqman
                  last edited by

                  @reqman said in WAN requiring root CA to be installed for internet access:

                  FYI host is a free ESX 5.5 hypervisor on an Xeon E5506 (yes, I know it's old).

                  That 'ESX 5.5' is probably the issue right now.
                  Check for yourself : install pfSense 2.7.2 on ESX 5.5 hypervisor and you won't find anybody talking about "5.5". It's version 8 or 7 if you have to.

                  Ok to keep old software. But mixing new stuff (pfSense 2.7.2 uses FreeBSD 14) on old stuff, is like installing windows 11 on a PC without a TPM : you can (probably) force it, but it needs uncommon knowledge to do so.

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  R 1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by stephenw10

                    You can enable the CE repos in the Net installer and install 2.7.2 from there.

                    Or you can install 2.7.2 using the legacy ISO image.

                    But, yes, you may find that ESXi version is too old to support it.

                    1 Reply Last reply Reply Quote 0
                    • bmeeksB
                      bmeeks @reqman
                      last edited by bmeeks

                      @reqman said in WAN requiring root CA to be installed for internet access:

                      Unfortunately, a bit later the VM shutted down by itself. Tried the exact same procedure, but no go.

                      The problem is likely the vmxnet3 driver. Change your virtual machine to use the e1000 NIC driver and try again. You will take a performance hit using the e1000 virtual driver, but that should let the newer pfSense boot and run.

                      I had this problem with a generic FreeBSD VM I had a couple of years ago. The newer FreeBSD versions have an updated vmxnet3 driver that apparently does not play well with older ESXi versions. Changing my VM to use the e1000 virtual NIC allowed it to boot and run. If the NIC driver is the problem, the machine crashes and reboots when the NIC driver loads. So, the machine starts booting and looks good, but then crashes when the NIC driver is loaded.

                      1 Reply Last reply Reply Quote 2
                      • R
                        reqman @Gertjan
                        last edited by

                        @Gertjan said in WAN requiring root CA to be installed for internet access:

                        Ok to keep old software. But mixing new stuff (pfSense 2.7.2 uses FreeBSD 14) on old stuff, is like installing windows 11 on a PC without a TPM : you can (probably) force it, but it needs uncommon knowledge to do so.

                        I know, but the iron does not support 6.0 and later.

                        @bmeeks said in WAN requiring root CA to be installed for internet access:

                        @reqman said in WAN requiring root CA to be installed for internet access:

                        Unfortunately, a bit later the VM shutted down by itself. Tried the exact same procedure, but no go.

                        The problem is likely the vmxnet3 driver. Change your virtual machine to use the e1000 NIC driver and try again. You will take a performance hit using the e1000 virtual driver, but that should let the newer pfSense boot and run.

                        Very useful info, thanks. Will give it a try, when I find some time to reschedule this experiment.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post