Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    Stuck on 26.03 RC

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    11 Posts 2 Posters 627 Views 3 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L Offline
      Lazer13
      last edited by Lazer13

      Hi,

      I can't get my 3100 at home to upgrade to the 26.03 release.
      I'm on pfSense-26.03.r.20260308.1443 and Update just shows RC Version (26.03).
      3f784554-d938-43d1-8241-c8677275a7a5-image.png

      I tried all the usual "not presented an update" troubleshooting from the netgate documentation but I always get things like this:

      pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-pfSense_plus_v26_03/data.pkg: response code 400

      check_upgrade: "Updating repositories metadata" returned error code 1

      Everything else seems to work just fine. DNS, Ipsec, tls, forwarding traffic to various vlans and internet seems fine.

      pkg-static install -fy pkg                                                                                                     
Updating pfSense-core repository catalogue...                                                                                                                                    
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-core/meta.conf: response code 400                                                     
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-core/meta.txz: response code 400                                                      
repository pfSense-core has no meta file, using default settings                                                                                                                 
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-core/data.pkg: response code 400                                                      
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-core/data.tzst: response code 400                                                     
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-core/packagesite.pkg: response code 400                                               
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-core/packagesite.tzst: response code 400                                              
Unable to update repository pfSense-core                                                                                                                                         
Updating pfSense repository catalogue...                                                                                                                                         
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-pfSense_plus_v26_03/meta.conf: response code 400                                      
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-pfSense_plus_v26_03/meta.txz: response code 400                                       
repository pfSense has no meta file, using default settings                                                                                                                      
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-pfSense_plus_v26_03/data.pkg: response code 400                                       
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-pfSense_plus_v26_03/data.tzst: response code 400                                      
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-pfSense_plus_v26_03/packagesite.pkg: response code 400                                
pkg-static: Failed to fetch https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-pfSense_plus_v26_03/packagesite.tzst: response code 400                               
Unable to update repository pfSense                                                                                                                                              
Error updating repositories!

      Any hints or troubleshooting steps spring to mind?

      Regards, Lars

      1 Reply Last reply Reply Quote 0
      • stephenw10S Offline
        stephenw10 Netgate Administrator
        last edited by

        Code 400 there looks like a connection issue. Since it's looking at armv7 I assume it's a 310 so that should always have access.

        Try running pfSense-repoc -NDJ and see what errors are shown. Or pkg-static -d update.

        Careful with that output though it may contain details that shouldn't really be posted publicly.

        Send me your NDI in chat and I'll check it.

        1 Reply Last reply Reply Quote 0
        • L Offline
          Lazer13
          last edited by

          Hi Stephen,
          Thanks for the suggestion. I had tried this command previously but now I read the output more carefully and a SSL certificare verification seems to be the cause of the 400 response.
          Not sure which cert it whines about. The one in the output looks fine to me.

          Updating pfSense-core repository catalogue...
          DBG(1)[20806]> PkgRepo: verifying update for pfSense-core
          DBG(1)[20806]> Pkgrepo, begin update of '/var/db/pkg/repos/pfSense-core/db'
          DBG(1)[20806]> (fetch) Request to fetch pkg+https://pfsense-plus-pkg.netgate.com/pfSense_plus-v26_03_armv7-core/meta.conf
          DBG(1)[20806]> (fetch) Fetch: fetcher used: pkg+https
          DBG(1)[20806]> (fetch) == Info: Couldn't find host pfsense-plus-pkg00.atx.netgate.com in the .netrc file; using defaults

          DBG(1)[20806]> (fetch) == Info: Host pfsense-plus-pkg00.atx.netgate.com:443 was resolved.

          DBG(1)[20806]> (fetch) == Info: IPv6: 2610:160:11:18::207

          DBG(1)[20806]> (fetch) == Info: IPv4: 208.123.73.207

          DBG(1)[20806]> (fetch) == Info: Trying [2610:160:11:18::207]:443...

          DBG(1)[20806]> (fetch) == Info: Immediate connect fail for 2610:160:11:18::207: No route to host

          DBG(1)[20806]> (fetch) == Info: Trying 208.123.73.207:443...

          DBG(1)[20806]> (fetch) == Info: ALPN: curl offers http/1.1

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: SSL Trust Anchors:

          DBG(1)[20806]> (fetch) == Info: CAfile: /etc/ssl/netgate-ca.pem

          DBG(1)[20806]> (fetch) == Info: CApath: /etc/ssl/certs/

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.3 (IN), TLS handshake, Server hello (2):

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (IN), TLS handshake, Certificate (11):

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (IN), TLS handshake, Server key exchange (12):

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (IN), TLS handshake, Request CERT (13):

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (IN), TLS handshake, Server finished (14):

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (OUT), TLS handshake, Certificate (11):

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (OUT), TLS handshake, CERT verify (15):

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (OUT), TLS handshake, Finished (20):

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: TLSv1.2 (IN), TLS handshake, Finished (20):

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) == Info: SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 / x25519 / RSASSA-PSS

          DBG(1)[20806]> (fetch) == Info: ALPN: server accepted http/1.1

          DBG(1)[20806]> (fetch) == Info: Server certificate:

          DBG(1)[20806]> (fetch) == Info: subject: C=US; ST=Texas; L=Austin; O="Rubicon Communications, LLC (Netgate)"; OU=pfSense Plus; CN=pfsense-plus-pkg00.atx.netgate.com

          DBG(1)[20806]> (fetch) == Info: start date: Mar 15 20:23:11 2022 GMT

          DBG(1)[20806]> (fetch) == Info: expire date: Feb 19 20:23:11 2122 GMT

          DBG(1)[20806]> (fetch) == Info: issuer: C=US; ST=Texas; L=Austin; O="Rubicon Communications, LLC (Netgate)"; OU=Netgate CA; CN=Netgate CA

          DBG(1)[20806]> (fetch) == Info: Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption

          DBG(1)[20806]> (fetch) == Info: Certificate level 1: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption

          DBG(1)[20806]> (fetch) == Info: common name: pfsense-plus-pkg00.atx.netgate.com (matched)

          DBG(1)[20806]> (fetch) == Info: SSL certificate verified via OpenSSL.

          DBG(1)[20806]> (fetch) == Info: Established connection to pfsense-plus-pkg00.atx.netgate.com (208.123.73.207 port 443) from 155.4.218.76 port 13470

          DBG(1)[20806]> (fetch) == Info: using HTTP/1.x

          DBG(1)[20806]> (fetch) => Send SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) => Send header, 0000000186 bytes (0x000000ba)
          DBG(1)[20806]> (fetch) GET /pfSense_plus-v26_03_armv7-core/meta.conf HTTP/1.1
          DBG(1)[20806]> (fetch) Host: pfsense-plus-pkg00.atx.netgate.com
          DBG(1)[20806]> (fetch) User-Agent: pkg/2.5.1
          DBG(1)[20806]> (fetch) Accept: /
          DBG(1)[20806]> (fetch) If-Modified-Since: Sun, 08 Mar 2026 14:57:40 GMT
          DBG(1)[20806]> (fetch)
          DBG(1)[20806]> (fetch) == Info: Request completely sent off

          DBG(1)[20806]> (fetch) <= Recv SSL data, 0000000000 bytes (0x00000000)
          DBG(1)[20806]> (fetch) <= Recv header, 0000000026 bytes (0x0000001a)
          DBG(1)[20806]> (fetch) HTTP/1.1 400 Bad Request
          DBG(1)[20806]> (fetch) <= Recv header, 0000000015 bytes (0x0000000f)
          DBG(1)[20806]> (fetch) Server: nginx
          DBG(1)[20806]> (fetch) <= Recv header, 0000000037 bytes (0x00000025)
          DBG(1)[20806]> (fetch) Date: Wed, 15 Apr 2026 05:55:45 GMT
          DBG(1)[20806]> (fetch) <= Recv header, 0000000025 bytes (0x00000019)
          DBG(1)[20806]> (fetch) Content-Type: text/html
          DBG(1)[20806]> (fetch) <= Recv header, 0000000021 bytes (0x00000015)
          DBG(1)[20806]> (fetch) Content-Length: 208
          DBG(1)[20806]> (fetch) <= Recv header, 0000000019 bytes (0x00000013)
          DBG(1)[20806]> (fetch) Connection: close
          DBG(1)[20806]> (fetch) <= Recv header, 0000000002 bytes (0x00000002)
          DBG(1)[20806]> (fetch)
          DBG(1)[20806]> (fetch) <= Recv data, 0000000208 bytes (0x000000d0)
          DBG(1)[20806]> (fetch) <html>
          DBG(1)[20806]> (fetch) <head><title>400 The SSL certificate error</title></head>
          DBG(1)[20806]> (fetch) <body>
          DBG(1)[20806]> (fetch) <center><h1>400 Bad Request</h1></center>
          DBG(1)[20806]> (fetch) <center>The SSL certificate error</center>
          DBG(1)[20806]> (fetch) <hr><center>nginx</center>
          DBG(1)[20806]> (fetch) </body>
          DBG(1)[20806]> (fetch) </html>
          DBG(1)[20806]> (fetch) == Info: shutting down connection #0

          1 Reply Last reply Reply Quote 0
          • stephenw10S Offline
            stephenw10 Netgate Administrator
            last edited by

            Yeah so it's throwing that 400 error because the client cert is bad. Probably because it needs to be updated.

            Running pfSense-repoc -NDJ should pull an updated client cert. That should show an error since it appears not to be.

            L 1 Reply Last reply Reply Quote 0
            • L Offline
              Lazer13 @stephenw10
              last edited by Lazer13

              @stephenw10 said in Stuck on 26.03 RC:

              pfSense-repoc -NDJ

              OS: FreeBSD
OS Version: 16.0-CURRENT
Platform: arm
Product: Netgate pfSense Plus
Version: 26.03-RC
FS type: ufs
Language: en_US
Model: Netgate 3100
NDI: REDACTED
Package prefix: pfSense-pkg-
Serial: REDACTED
Repo path: /usr/local/etc/pfSense
Request query: {"platform":"Netgate 3100","os":"FreeBSD","osver":"16.0-CURRENT","prod":"Netgate pfSense Plus","ver":"26.03-RC","ed":"Plus","fstype":"ufs","pkgs":"[{\"name\":\"System_Patches\",\"ver\":\"2.3\"},{\"name\":\"Status_Traffic_Totals\",\"ver\":\"2.3.5_2\"}]"}
POST data: REDACTED
{
    "repos": {
        "repo": [

        ]
    },
    "links": {
        "next": null,
        "previous": null
    },
    "count": 0,
    "messages": [
        "Your Netgate device has pfSense+ as part of your device purchase."
    ],
    "messages_text": [
        "Your Netgate device has pfSense+ as part of your device purchase.",
        "Your Netgate device has pfSense+ as part of your device purchase."
    ],
    "pubkey": {
        "type": "RSA",
        "key": "MIICIjREDACTEDkU40CAwEAAQ==\n"
    },
    "signature": {
        "type": "RSA",
        "signature": "eZb+waj19yZnC1iyeREDACTED2ndFzMQ=",
        "key_signed": "repos.repo"
    }
}
Messages:
Your Netgate device has pfSense+ as part of your device purchase.

              Weird that the repo section is empty.

              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                Hmm, indeed. Can you send me your NDI in chat and I'll check the server side.

                L 1 Reply Last reply Reply Quote 0
                • L Offline
                  Lazer13 @stephenw10
                  last edited by

                  @stephenw10 After Stephen found and fixed something magical on the server side I got it to display the release branch of 26.03.
                  It did however still said I was on the latest version.

                  Running pkg-static -d update now completed without errors and running pfSense-repoc -NDJ had info in the repo section.

                  Still no new version presented.

                  pkg-static install -fy pkg failed to complete because of pkg-static: No trusted public keys found

                  In the troubleshooting upgrades guide this suggests that a reinstall might be needed but you could try to fetch a file with public keys from github.

                  This did not help.

                  It did ring a bell in the back of my head that I had been down this road before, years ago.
                  The fix then was to replace all the files in the /usr/local/share/pfSense/keys/pkg/trusted/ folder. Not only the one pulled from github.
                  I pulled these files from one of the 8200:s at work and overwrote the ones on my 3100:
                  beta.pfsense.org.20151223
                  ce-beta.pfsense.org.20151223
                  ce-pkg.pfsense.org.20160406
                  pkg.pfsense.org.20160406

                  Lo and behold. Everything works again and it let me do the upgrade.

                  L 1 Reply Last reply Reply Quote 0
                  • L Offline
                    Lazer13 @Lazer13
                    last edited by

                    Turns out that the one on github contained the wrong fingerprint.
                    So the copying from another system would probably not have been needed.

                    L 1 Reply Last reply Reply Quote 0
                    • L Offline
                      Lazer13 @Lazer13
                      last edited by

                      I made a bug report in redmine: https://redmine.pfsense.org/issues/16794

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator
                        last edited by

                        The key on github is correct for CE but not for Plus.

                        The instructions in the docs here: https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html are for CE only but that could be very easy to ovcerlook. I'll see what we can do to make that clearer.

                        L 1 Reply Last reply Reply Quote 1
                        • L Offline
                          Lazer13 @stephenw10
                          last edited by

                          @stephenw10 Ah indeed I overlooked that one.
                          If you also provide links in the doc to the correct one for plus it would be a lot clearer.
                          (and helpful :))

                          1 Reply Last reply Reply Quote 1
                          • First post
                            Last post
                          Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.
                          Privacy Policy · Cookie Policy