Error renewing Certificate (WebGUI)

MoonLight 0

Hello all,

I'm currently running the 25.11.1-RELEASE (amd64) (FreeBSD 16.0-CURRENT) on my pfSense with OpenSSL 3.5.3 (16 Sep 2025) and when I try to renew my self-signed certificate I get the following error:

The following input errors were detected:
Error renewing Certificate

I tried to create a new Internal Certificate Authority (this works) but then when I create a new Internal Certificate with this CA, this one is empty (no Certificate Data).

I also tried via cli:

pfSsh.php playback generateguicert
Generating a new self-signed SSL/TLS certificate for the GUI...Error creating certificate

Would you have any clues?

Thank you!

stephenw10

Any errors in the main system log when you run either of those?

MoonLight 0

Unfortunately, no...

I only got this log when I tried with the command line:

pfSsh.php: Creating self-signed SSL/TLS certificate ()

That's all :(

stephenw10

Ok try this. In Diag > Command Prompt run the following in the Execute PHP commands box:

require_once('certs.inc');
$cert = cert_create_selfsigned('Test','');
if (is_array($cert) && !empty($cert)) {
	echo gettext("Done.\n");
} else {
	echo gettext("Error creating certificate");
}

I expect that to fail the same way but it might throw an additional error.

stephenw10

Also check: /tmp/php_errors.txt

MoonLight 0

Hello @stephenw10,

I get the same error message (see screenshot)

In the System logs, I can only see:

php[99254]: /tmp/user_code/38rhpo64rm512ZiXz2G: Creating self-signed SSL/TLS certificate (Test)

And no new certificate created under System > Certificates > Certificates.

Thanks for your help.

MoonLight 0

@stephenw10

And here is my /tmp/php_errors.txt

pkg-static: Warning: Major OS version upgrade detected.  Running "pkg bootstrap -f" recommended
[: NaN: bad number

That's probably the issue.

stephenw10

Hmm, nope that error is 'normal'. It shouldn't prevent the cert being created.

Let me dig further...

stephenw10

Hmm, do you have a hostname set with unusual characters? Or no hostname?

Try:

require_once('certs.inc');
$cert = cert_create_selfsigned('Test','testhost');
if (is_array($cert) && !empty($cert)) {
	echo gettext("Done.\n");
} else {
	echo gettext("Error creating certificate");
}

Otherwise it should log an error from openssl if it actually tries to create the cert.
https://github.com/pfsense/pfsense/blob/master/src/etc/inc/certs.inc#L3081

MoonLight 0

@stephenw10

Here is the output with your new PHP command:

And in the logs I only get:

php	35411	/tmp/user_code/o4kmfh2a8f6o0Qo3myW: Creating self-signed SSL/TLS certificate (Test)

Thanks.

MoonLight 0

@stephenw10 Looks like I'm missing a lot of packages, can it be related?

pkg-static check -n
curl-8.16.0: missing file /usr/local/share/aclocal/libcurl.m4
dbus-1.16.2_4,1: missing file /usr/local/share/xml/dbus-1/busconfig.dtd
dbus-1.16.2_4,1: missing file /usr/local/share/xml/dbus-1/catalog.xml
dbus-1.16.2_4,1: missing file /usr/local/share/xml/dbus-1/introspect.dtd
glib-2.84.1_3,2: missing file /usr/local/share/aclocal/glib-2.0.m4
glib-2.84.1_3,2: missing file /usr/local/share/aclocal/glib-gettext.m4
glib-2.84.1_3,2: missing file /usr/local/share/aclocal/gsettings.m4
libgcrypt-1.11.2: missing file /usr/local/share/aclocal/libgcrypt.m4
libgpg-error-1.55: missing file /usr/local/share/aclocal/gpg-error.m4
libgpg-error-1.55: missing file /usr/local/share/aclocal/gpgrt.m4
libmcrypt-2.5.8_4: missing file /usr/local/share/aclocal/libmcrypt.m4
mpdecimal-4.0.1: missing file /usr/local/share/doc/mpdecimal/COPYRIGHT.txt
pfSense-system-25.11.1600002: checksum mismatch for /etc/bogons
pfSense-system-25.11.1600002: checksum mismatch for /etc/bogonsv6
pfSense-system-25.11.1600002: checksum mismatch for /etc/inc/services.inc
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/af/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/ar/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/bs/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/ca/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/cs/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/da/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/de_DE/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/el/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/en_US/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/es/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/es_AR/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/es_ES/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/es_MX/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/fa/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/fi/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/he/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/hi/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/hr/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/hu/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/id/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/it/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/ja/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/lv/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/ms/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/ne/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/pot/pfSense.pot
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/pt_BR/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/pt_PT/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/ro/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/sk/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/sl/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/sq/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/sr_Latn/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/sv/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/sw/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/th/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/tr/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/zh_CN/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/zh_Hans_CN/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/locale/zh_TW/LC_MESSAGES/pfSense.po
pfSense-system-25.11.1600002: missing file /usr/local/share/pfSense/keys/pkg/revoked/.empty
pfSense-system-25.11.1600002: missing file /usr/local/www/widgets/include/thermal_sensors.inc
php84-pear-Auth_RADIUS-1.1.0_4: missing file /usr/local/share/doc/pear/Auth_RADIUS/examples/radius-acct.php
php84-pear-Auth_RADIUS-1.1.0_4: missing file /usr/local/share/doc/pear/Auth_RADIUS/examples/radius-auth.php
php84-pear-Cache_Lite-1.8.3,1: missing file /usr/local/share/doc/pear/Cache_Lite/LICENSE
php84-pear-Cache_Lite-1.8.3,1: missing file /usr/local/share/doc/pear/Cache_Lite/README.md
php84-pear-Cache_Lite-1.8.3,1: missing file /usr/local/share/doc/pear/Cache_Lite/TODO
php84-pear-Cache_Lite-1.8.3,1: missing file /usr/local/share/doc/pear/Cache_Lite/docs/examples
php84-pear-Cache_Lite-1.8.3,1: missing file /usr/local/share/doc/pear/Cache_Lite/docs/technical
php84-pear-HTTP_Request2-2.7.0,1: missing file /usr/local/share/doc/pear/HTTP_Request2/LICENSE
php84-pear-HTTP_Request2-2.7.0,1: missing file /usr/local/share/doc/pear/HTTP_Request2/examples/upload-rapidshare.php
php84-pear-Mail-2.0.0,1: missing file /usr/local/share/doc/pear/Mail/LICENSE
php84-pear-Net_SMTP-1.12.1: missing file /usr/local/share/doc/pear/Net_SMTP/LICENSE
php84-pear-Net_SMTP-1.12.1: missing file /usr/local/share/doc/pear/Net_SMTP/README.rst
php84-pear-Net_SMTP-1.12.1: missing file /usr/local/share/doc/pear/Net_SMTP/examples/basic.php
php84-pear-Net_Socket-1.2.2: missing file /usr/local/share/doc/pear/Net_Socket/LICENSE
php84-pear-Net_Socket-1.2.2: missing file /usr/local/share/doc/pear/Net_Socket/README.md
php84-pear-Net_URL2-2.2.3: missing file /usr/local/share/doc/pear/Net_URL2/docs/6470.php
php84-pear-Net_URL2-2.2.3: missing file /usr/local/share/doc/pear/Net_URL2/docs/BSD-3-CLAUSE-Heyes
php84-pear-Net_URL2-2.2.3: missing file /usr/local/share/doc/pear/Net_URL2/docs/example.php
php84-pear-XML_RPC2-1.1.5: missing file /usr/local/share/doc/pear/XML_RPC2/docs/Makefile
php84-pear-XML_RPC2-1.1.5: missing file /usr/local/share/doc/pear/XML_RPC2/docs/tutorials/XML_RPC2.lyx
pkcs11-helper-1.29.0_3: missing file /usr/local/share/aclocal/pkcs11-helper-1.m4

Thank you!

jimp

There should be a message in the log from OpenSSL unless your default log level is set too high. Check Status > System Logs, Settings tab and make sure Default Log Level is set to at least Notice or Warning, save and then try the test again.

stephenw10

Nope, pfSense doesn't ship with man files or examples etc. That's expected.

I assume this just returns the same error?

require_once('certs.inc');
$cert = cert_create_selfsigned('Test','testhost');
if (is_array($cert) && !empty($cert)) {
	echo gettext("Done.\n");
} else {
	echo gettext("Error creating certificate");
}
var_dump($cert);

The cert array is not populated at all?

Does that tmp file remain? /tmp/user_code/o4kmfh2a8f6o0Qo3myW

MoonLight 0

I don't have this Default Log Level under Status > System Logs, Settings:

This time I get another error:

Error creating certificateNULL

And the file has been removed:

/tmp/user_code/o4kmfh2a8f6o0Qo3myW: No such file or directory

MoonLight 0

@stephenw10 using the command prompt I was able to get this error if it can help:

<pre style="white-space: pre-wrap;">PHP ERROR: Type: 1, File: /etc/inc/certs.inc, Line: 384, Message: Uncaught TypeError: Cannot access offset of type string on string in /etc/inc/certs.inc:384
Stack trace:
#0 /tmp/user_code/9bdss0kt4f9vaePJRbe(19): cert_create(&#039;&#039;, NULL, 2048, 365, Array, &#039;self-signed&#039;, &#039;sha256&#039;)
#1 {main}
  thrown</pre>

Thanks.

jimp

@MoonLight-0 said in Error renewing Certificate� (WebGUI):

@stephenw10 using the command prompt I was able to get this error if it can help:

<pre style="white-space: pre-wrap;">PHP ERROR: Type: 1, File: /etc/inc/certs.inc, Line: 384, Message: Uncaught TypeError: Cannot access offset of type string on string in /etc/inc/certs.inc:384
Stack trace:
#0 /tmp/user_code/9bdss0kt4f9vaePJRbe(19): cert_create(&#039;&#039;, NULL, 2048, 365, Array, &#039;self-signed&#039;, &#039;sha256&#039;)
#1 {main}
  thrown</pre>

I'm not seeing how that could happen given the example code above, did you run something different? That implies the $cert parameter passed to the function was an empty string ('') but the cert_create_selfsigned() function creates it as an array and doesn't change it in any way that would make it a string.

MoonLight 0

You're right about the test script, I initialized $cert as a string which caused the TypeError. However, even when initializing it correctly as an array, the function cert_create() returns false without any OpenSSL error string.

More importantly, I've identified a deeper system issue:

pkg-static check -n reports a checksum mismatch for /etc/inc/services.inc.
A direct fetch test returns: fetch: Address family for host not supported even when forcing IPv4 with -4.
ping -c 3 8.8.8.8 works perfectly (1ms), but any SSL-reliant tool (fetch, pkg, cert_create) seems 'blind' to the network or the SSL config.

It looks like my shared libraries or system files are corrupted.
Do you recommend a forced reinstall of pfSense-system and pfSense-base via pkg-static?

jimp

The OpenSSL error wouldn't be returned by that function it would be logged into the main system log.

A mismatch on services.inc could be from a system patch, it isn't necessarily a problem.

There might be something more fundamental that's broken if you can't hit anything with SSL/TLS at all, pkg reinstalls may not work either.

Sounds like a reinstall+restore would be the best course of action.

MoonLight 0

Ok, I will schedule a maintenance and I will keep you posted, thank you all for your help!

MoonLight 0

FYI: Upgrading the pfSense to v26.03 fixed the issue, I was able to renew the certificate.
I think one of the core files (specifically services.inc) was corrupted.

This issue has been resolved. Thank you all.