Error on Third-Party HW: "Nexus cannot be licensed"

willcycle

Never mind. AI came thru.

rlad

I see a lot of people trying to get Nexus up and running here. I’m having the same problem with my PFsense+ on my Nexus hardware.

But I don’t understand why this is being made so complicated now. Are we being forced to use Netgate hardware?

And am I understanding this correctly—that the old GUI we’ve been using will eventually no longer be available?

I’m running pFSense+ on a mini PC with AMIBIOS. That means I have to figure out a way to enter this serial number into the BIOS.

But in my opinion, that’s not right.

stephenw10

Just to be clear to the pfnet-controller service fails to start entirely?

JeGr

@stephenw10 said in Error on Third-Party HW: "Nexus cannot be licensed":

Just to be clear to the pfnet-controller service fails to start entirely?

I see the same problem. Hardware that's running for years is now "off the table" for the new UI as well as VMs as they're not "secure enough?"
It's simply strange.

I have a FW7525 (good quality Lanner hardware, that Netgate/pfSense was also using a few years ago as "FW7525", Atom C2558 based) running as a lab box. Updated after the Home&Lab license mess was cleared up. Checked the Nexus GUI, seemed to work. Wanted to write "hey everything's fine now" but after heading over to Packages in Nexus UI and trying to install Snort - POW - no deal: failed to check license status: 400 Bad Request xxxyyy device fingerprint not recognized

Checking the dashboard it now shows the new line with "serial" and - strange enough - the box seems to have no serial# set by the OEM as it shows "to be filled by O.E.M." - so that seems to displease Nexus now and it's no wanting to download stuff because the box is not secure enough. And that's no chinese 50$ box, that hardware (the same as your old FW7525 offer) was expensive at that time. OK it only runs as lab hardware now, but what's wrong with it now just because an arbitrary BIOS field doesn't have some nonsensical serial number in it that hardware is now locked out?

I'd really like to understand the reason behind it, if you could help me. First VMs, now older hardware of the same type Netgate itself still used a while ago. If I used an older NCA1510 (an unbranded Netgate 5100) - would the same happen and why?

@rlad said in Error on Third-Party HW: "Nexus cannot be licensed":

But I don’t understand why this is being made so complicated now. Are we being forced to use Netgate hardware?

That's exactly what customers of ours are asking now. Are we pushed out to only buy "certified hardware" now? Especially when year after year the biggest pitch for pfSense was "no license hassle, low TCO and hardware agnostic without you needing to buy the right hardware" that change in 26.07 really feels strange to a lot of customers here. So it'd be nice if we could understand if that's a silly bug or if more's coming like that?

Thanks and Cheers :)
\jens

Edit:
just as comparison, old GUI and Nexus:

As no one new, that a serial field that was never even shown in the normal GUI would some day be relevant, that field being empty/not set wasn't even known up until now.

stephenw10

Hmm, if it was able to upgrade it should be valid. Let me check....

JeGr

@stephenw10 said in Error on Third-Party HW: "Nexus cannot be licensed":

Hmm, if it was able to upgrade it should be valid. Let me check....

it's similar to the VMs (they even have a serial number set via the Hypervisor) that get denied access to the package manager after updating, too. The only difference is that the VMs show the errors earlier (e.g. directly when entering the package manager) while the hardware lab box only showed it after loading the package archive and trying to install snort3 (as a perhaps "protected" package - as in it won't show up in the normal GUI to install, only via package manager in Nexus).

stephenw10

Yeah, that definitely seems to be some edge case. Can you send me the full NDI and licence phrase in chat. What I'm seeing on the back end doesn't line up....

rlad

I contacted the Netgate TAC today and received the following response:

Hello.

Unfortunately, Nexus licensing is officially supported only on Netgate hardware or AWS and Azure VMs.
https://docs.netgate.com/pfsense/en/latest/nexus/license/index.html#licensing-requirements
Sorry for the inconvenience.

According to my current information, there are no plans to remove the PHP GUI in its current form.

marcosm

The initial release of the licensing system in Nexus is meant to support official Netgate instances. We are working to expand licensing capabilities in a future release.

marcg

@JeGr said in Error on Third-Party HW: "Nexus cannot be licensed":

As no one new, that a serial field that was never even shown in the normal GUI would some day be relevant, that field being empty/not set wasn't even known up until now.

There's a perhaps too-short length limitation -- 16 characters -- on the serial number in the classic GUI, too.

skogs

Nexus package upgrade today _1 version seems to have allowed my hardware to run correctly. I did not need to bring it down and put a fake serial or anything into the coreboot system.

It is different. I don't like change.

It seems pretty functional though.

kikuyu

@skogs Same for me. I updated the Nexus pkg and my box is running without error concerning the serial number.
Good .

JeGr

@skogs said in Error on Third-Party HW: "Nexus cannot be licensed":

Nexus package upgrade today _1 version seems to have allowed my hardware to run correctly. I did not need to bring it down and put a fake serial or anything into the coreboot system.

It is different. I don't like change.

It seems pretty functional though.

@marcosm Is there a possibility to manually install that _1 update to get the updated nexus and pkg stuff on my box? My hardware was doing fine until updating to 26.07 and now the normal GUI shows "all fine, no updates". Only checking on the console and Nexus I still got license and certificate errors and the box won't update anything, won't install packages etc. as it can't access the repositories anymore:

pfSense-repoc-static: zuul_repo_fetch: Failed to read the repository data (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10416 d83e67bd5fe056aefdcb54988f3334f4


>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
1000E0008E020000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-main/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.c:2125:

As described above, that is the same hardware box running a C2558 Atom that didn't had any problems up until now with the weird serial number checking.

Cheers

stephenw10

Mmm, that's unrelated to the serial/nexus issue AFAIK. But it can be fixed by removing the zuul CA like:
https://forum.netgate.com/topic/201408/getting-the-following-error-when-trying-to-update-unbound-package-in-ssh-or-command-in-gui

JeGr

@stephenw10 said in Error on Third-Party HW: "Nexus cannot be licensed":

Mmm, that's unrelated to the serial/nexus issue AFAIK. But it can be fixed by removing the zuul CA like:
https://forum.netgate.com/topic/201408/getting-the-following-error-when-trying-to-update-unbound-package-in-ssh-or-command-in-gui

The commands didn't seem to work for me. After the pkg-updates at the end, it still quits with bad requests and certificate verification faults

An update from console still triggers this:

pfSense-repoc-static: zuul_license_check: Failed to check the license (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10405 1390431b2cf063b9fe04cf91d357307d device fingerprint not recognized


pfSense-repoc-static: zuul_license_fetch: Failed to check the license (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10405 52770b76e62725a769309a625bbabf38 device fingerprint not recognized


pfSense-repoc-static: zuul_repo_fetch: Failed to read the repository data (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10416 bc53770c662be99fce698de0d1d62e79


>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
1000A05AEE200000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-main/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
1000A05AEE200000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-main/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
...
many errors more

JeGr

@stephenw10 @marcosm

Also I did double-check that the zuul CA was definetly deleted and seemingly recreated. But the error still persists.

JeGr

OK manually resetting and rebuilding the nexus license with help from @marcosm finally got things back in order. After stopping the service, resetting and deleting the license and removing it from the database tables, too, it finally got recreated completely and afterwards pkg finally got working again.