Upgraded from 25.07 -> 25.11 webGUI not working

thezfunk

Hi Guys,

I upgraded my pfSense box and can not get back into the webgui. On startup, I see:

Starting webConfigurator...failed!

From the console I have tried:
restarting webgui
restarting php
restoring previous configuration
I even went to the documentation and tried Forced pkg Reinstall.

My last option is to restore defaults and/or try reinstalling from scratch. Any other ideas? I am passing traffic as I am able to post this.

luckman212

Sounds like you have console access, so you could try

touch /verbose_rc

And reboot to see if there's anything useful shown with that extra level of logging enabled.

patient0

@thezfunk on what port is the webGUI listening, and does anything else run on it. Like a 443 port forward on WAN?

Is pfSense+ running on ZFS, if yes you can go back to 25.07. In the boot menu there is option 8 which let you choose the snapshot to boot. And on every upgrade pfSense automatically creates one.

https://docs.netgate.com/pfsense/en/latest/backup/zfsbe/loader.html

thezfunk

@patient0 said in Upgraded from 25.07 -> 25.11 webGUI not working:

@thezfunk on what port is the webGUI listening, and does anything else run on it. Like a 443 port forward on WAN?

Is pfSense+ running on ZFS, if yes you can go back to 25.07. In the boot menu there is option 8 which let you choose the snapshot to boot. And on every upgrade pfSense automatically creates one.

https://docs.netgate.com/pfsense/en/latest/backup/zfsbe/loader.html

I do have a domain that points home to my pfsense box. It listens on the WAN on port 443 and sends it in to my reverse prox and then on from there but that was never an issue before the upgrade.

patient0

@thezfunk said in Upgraded from 25.07 -> 25.11 webGUI not working:

I do have a domain that points home to my pfsense box. It listens on the WAN on port 443 and sends it in to my reverse prox and then on from there but that was never an issue before the upgrade.

I don't know if something changed but I think to remember some else having an issue (can't find it right now, I keep searching).

What is certain is that nginx which serves the webGUI is listening on all interfaces.

You can run sockstat | fgrep :443 to if nginx is running and listening at all. Or `sockstat | egrep ':(80|443)' to check for both http and https ports.

SteveITS

@thezfunk You might check the https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html#upgrade-log, system log, nginx log to see why it’s not starting.

Sine you have Plus and a working console you can revert to a 25.07 BE via the menu.

thezfunk

@SteveITS said in Upgraded from 25.07 -> 25.11 webGUI not working:

Sine you have Plus and a working console you can revert to a 25.07 BE via the menu.

I don't see where you can revert from the menu?

SteveITS

@thezfunk as it’s booting: https://docs.netgate.com/pfsense/en/latest/backup/zfsbe/loader.html

thezfunk

said in Upgraded from 25.07 -> 25.11 webGUI not working:

Even if I didn't install with ZFS?

SteveITS

@thezfunk well then no, BEs are a ZFS feature.

thezfunk

Well, no matter how I installed or reinstalled or restored to 25.11, the web interface failed to start. So, I reinstalled 25.07.1 and loaded my config file/backup. No issues.

I don't know why 25.11 is breaking the web interface and what possibly might be in my configuration that could do it?

stephenw10

Check the nginx and system logs. That should show something if it fails to start. But I would also guess it's trying to listen on a port that's already in use.

It could also be a cert issue. Are you using a custom imported cert for the webgui? nginx in 25.11 tightened the requirements there and a custom cert may not meet it. Specifically the RSA key should be at least 2048bits.

IcePick

@stephenw10 had the same problem over the weekend with a system, just checked and found they had 1024bit certs (not custom though). I have rekeyed them with 2048 and will try again next weekend when I can be onsite in case It goes bad again.

MrTrophy

@stephenw10 Sadly, I have already updated my pfSense to version 25.11, and now I get the following error during startup and the WebGUI cannot start.

Jan  5 17:10:44 pfSense php-cgi[12053]: rc.restart_webgui: The command '/usr/local/sbin/nginx -c /var/etc/nginx-webConfigurator.conf' returned exit code '1', the output was 'nginx: [emerg] SSL_CTX_use_certificate("/var/etc/cert.crt") failed (SSL: error:0A00018F:SSL routines::ee key too small)'

Is there a way to fix this using SSH? I cannot revert to an older version since ZFS does not seem to be active, even though it is a Plus version.

luckman212

@MrTrophy Have you tried this command from SSH/console?

pfSsh.php playback generateguicert

stephenw10

Yup, that^. You can generate a new cert using the PHP shell.

See: https://docs.netgate.com/pfsense/en/latest/troubleshooting/locked-out.html#https-certificate-problems

thezfunk

@luckman212 said in Upgraded from 25.07 -> 25.11 webGUI not working:

@MrTrophy Have you tried this command from SSH/console?
pfSsh.php playback generateguicert

If I do that in 25.07.1 before I upgrade to 25.11 will the newly generated certificate be 2048 and compatible for upgrade?

stephenw10

Yes

SteveITS

@thezfunk Before upgrade, you can also renew the cert from System > Certificates > Certificates, and review the "would change" column and/or "Strict Security" checkbox.

jimp

I added a warning about this issue to the release notes, with workarounds:

https://docs.netgate.com/pfsense/en/latest/releases/25-11.html#tls-certificate-strength