GUI not accessible after 26.03 update

phibster

I was using a 1024 bit self-signed certificate with my GUI for internal HTTPS only. After applying the 26.03 update the GUI no longer loads and checking /var/log/nginx/error.log I see the following:

2026/04/20 16:35:38 [emerg] 52097#101560: SSL_CTX_set0_chain("/var/etc/cert.crt") failed (SSL: error:0A00018D:SSL routines::ca key too small)

Is there a way to correct this as I used this pfSense as the CA for all my local self-signed certificates and don't really want to go through the hassle of re-installing new certificates to those devices (if possible!!!)

luckman212

@phibster you can (re)generate the webconfigurator certs from the console with

pfSsh.php playback generateguicert

but I'm pretty sure you're going to need to manually trust the new cert on your devices.

Gertjan

@phibster said in GUI not accessible after 26.03 update:

I was using a 1024 bit self-signed certificate with my GUI for internal HTTPS only. After applying the 26.03 update the GUI no longer loads and checking /var/log/nginx/error.log I see the following:

..... > (your) ca key (is) too small)

True.
Recent version of OpenSSL won't trust/accept 1024 bit keys anymore.

here : Netgate Releases pfSense Plus Software Version 26.03

Somehow the upgrade process managed not to inform you about :

@phibster said in GUI not accessible after 26.03 update:

go through the hassle of re-installing new certificates to those devices

Be careful.
Everything and everybody uses openssl. If one of these device also upgrades its firmware, you wind up with the same problem.
I guess you're in for some hassle ^^

phibster

@luckman212 said in GUI not accessible after 26.03 update:

@phibster you can (re)generate the webconfigurator certs from the console with
pfSsh.php playback generateguicert
but I'm pretty sure you're going to need to manually trust the new cert on your devices.

Thank you! This got it working. Now to regenerate a new larger CA and local certificates.

jimp

Did you have a single self-signed GUI certificate, or did you have a local self-signed CA and a GUI certificate signed by that CA?

The upgrade code in 26.03 checks for and auto-generates new GUI certs if it detects one that would fail to run, but there are a lot of edge cases out there it couldn't cover.

phibster

@jimp said in GUI not accessible after 26.03 update:

local self-signed CA and a GUI certificate signed by that CA

I had the local CA and gui cert signed.