26.03.1: pkg update fails with “400 The SSL certificate error” due to expired pfSense-repo client certificate

FoxKyong

Hi,

after upgrading to pfSense Plus 26.03.1-RELEASE amd64, direct CLI package updates started failing with:

pkg update
pkg-static update -f

Both failed with HTTP 400 from the Netgate pfSense Plus package repository:

HTTP/1.1 400 Bad Request
400 The SSL certificate error

This happened for both IPv6 and IPv4.

IPv6 example:
pfsense-plus-pkg01.atx.netgate.com (2610:160:11:18::209 port 443)

IPv4 example:
pfsense-plus-pkg00.atx.netgate.com (208.123.73.207 port 443)
pfsense-plus-pkg01.atx.netgate.com (208.123.73.209 port 443)

The Netgate server certificate validated successfully in the debug output:

SSL certificate verified via OpenSSL.

The SRV records also resolved correctly:

_https._tcp.pfsense-plus-pkg.netgate.com has SRV record 10 10 443 pfsense-plus-pkg00.atx.netgate.com.
_https._tcp.pfsense-plus-pkg.netgate.com has SRV record 10 10 443 pfsense-plus-pkg01.atx.netgate.com.

The local pfSense Plus repository client certificate in:

/usr/local/etc/pfSense/pkg/repos/pfSense-repo-0000-cert.pem

was expired:

notBefore=Jun 6 22:45:45 2026 GMT
notAfter=Jun 7 10:45:45 2026 GMT

The failing repository request happened after that expiration time:

Date: Sun, 07 Jun 2026 18:51:24 GMT

The certificate and private key matched. The SHA256 modulus hashes were identical:

SHA2-256(stdin)= 1b93a38ef0e91efd7d7f63a81e8136031c31d0859632d6410735485eee2aa026

After deleting/regenerating the repository client certificate and key under:

/usr/local/etc/pfSense/pkg/repos/

a new short-lived certificate was issued:

notBefore=Jun 7 18:56:25 2026 GMT
notAfter=Jun 8 06:56:25 2026 GMT

After that, pkg-static update -f worked again:

Updating pfSense-core repository catalogue...
pfSense-core repository update completed. 5 packages processed.
Updating pfSense repository catalogue...
pfSense repository update completed. 766 packages processed.
All repositories are up to date.

This looks like the cached pfSense Plus repository client certificate expired and direct CLI pkg update/pkg-static update -f did not refresh it automatically before contacting the repository.

This used to work for years before the latest upgrade, so I am wondering whether this is a known 26.03.1 regression or if there is a recommended way to refresh the short-lived pfSense-repo client certificate before using pkg from the CLI.

Workaround that fixed it locally:
delete/regenerate the files in /usr/local/etc/pfSense/pkg/repos/ and then run pkg-static update -f again.

Should this be reported in Redmine as a regression, or is there an expected command/workflow for refreshing the pfSense Plus repo client certificate before using pkg from the terminal?

Thanks.

stephenw10

That behaviour hasn't actually changed in 26.03.1, pkg always failed at the CLI if the client cert has expired.

Either load the GUI or run pfSense-repoc -N at the CLI to pull a new cert.