• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

issue with certificates

General pfSense Questions
certificates pfsense 24.11
4
6
227
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • H
    hspindel
    last edited by Mar 9, 2025, 10:40 AM

    Hello,

    Running pfSense+ 24.11 on Netgate 8200.

    System/Certificates tells me I have a valid self-signed certificate (valid until 5/24/25).

    Whenever I use a browser (Firefox or Chrome) access the pfSense GUI I get errors:

    Chrome reports ERR_CERT_AUTHORITY_INVALID
    Firefox reports some other error.

    What am I missing to fix this?

    G 1 Reply Last reply Mar 9, 2025, 11:50 AM Reply Quote 0
    • G
      Gertjan @hspindel
      last edited by Mar 9, 2025, 11:50 AM

      @hspindel said in issue with certificates:

      Chrome reports ERR_CERT_AUTHORITY_INVALID
      Firefox reports some other error.

      Certificates are signed by some kind of authority.
      Your browser (all browsers) have a list with the known ones, they are from Microsoft, Apple, Google, Verisign etc. Here is a list.
      So when you visit a web site on the net, and the root CA belong top one of them, the certificate of the web site is trusted by default.
      You could do this test : your browser (any browser) has a folder somewhere where it stores a copy of all the CA's. It could be local to the browser, or the OS's system wide list.
      Delete (no, move them to a safe place, elsewhere) all those that come from Microsoft and restart your browser. Then visit a Microsoft web site. It will now fail to show the site .... it doesn't trust microsoft anymore.

      Now you now what to do so the browser accepts the pfSense web server as 'valid' (no errors) : export the CA created on pfSense, the one used to create the pfSense webserver's certificate, and import it into your device (browser or cert storage).
      From now on your browser will trust the certificate from pfSense as it was created by a CA that you've created. And, normally, you trust yourself. This CA is know as an auto signed CA certificate.

      How and what to do : look for the posts of the forum user johnpoz, or dig a bit in the pfSense documentation , you'll find how to export the CA and what to do with on your own device, the one you use to access pfSense.

      Be ware : this isn't how pfSense handles certificate stuff, is common to everything related to certificates. It's part of the what https or actually any TLS communication is all about.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      J 1 Reply Last reply Mar 9, 2025, 12:29 PM Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator @Gertjan
        last edited by johnpoz Mar 9, 2025, 12:31 PM Mar 9, 2025, 12:29 PM

        @hspindel Here is one of the posts @Gertjan is talking about - where I go over how to create a CA and have your browser trust certs signed by it

        https://forum.netgate.com/post/831783

        You can make it good for like 10 years if you want - browsers still ok with long valid certs with your own CA.

        🔒 Log in to view

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • S
          stephenw10 Netgate Administrator
          last edited by Mar 9, 2025, 8:40 PM

          Yeah you can just add an exception in the browser to allow the self signed cert. You don't actually need to add the CA cert.

          J 1 Reply Last reply Mar 9, 2025, 9:05 PM Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator @stephenw10
            last edited by Mar 9, 2025, 9:05 PM

            @stephenw10 firefox makes it easy to do that - but I think like chrome you have to type something there is no button to click to trust it.. Until you type the magic word ;)

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            H 1 Reply Last reply Mar 12, 2025, 7:17 AM Reply Quote 0
            • H
              hspindel @johnpoz
              last edited by Mar 12, 2025, 7:17 AM

              Thank you all for your comments.

              Not sure what I did, but Firefox stopped complaining.

              1 Reply Last reply Reply Quote 1
              6 out of 6
              • First post
                6/6
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.