Error on Third-Party HW: "Nexus cannot be licensed"

rlad

I contacted the Netgate TAC today and received the following response:

Hello.

Unfortunately, Nexus licensing is officially supported only on Netgate hardware or AWS and Azure VMs.
https://docs.netgate.com/pfsense/en/latest/nexus/license/index.html#licensing-requirements
Sorry for the inconvenience.

According to my current information, there are no plans to remove the PHP GUI in its current form.

marcosm

The initial release of the licensing system in Nexus is meant to support official Netgate instances. We are working to expand licensing capabilities in a future release.

marcg

@JeGr said in Error on Third-Party HW: "Nexus cannot be licensed":

As no one new, that a serial field that was never even shown in the normal GUI would some day be relevant, that field being empty/not set wasn't even known up until now.

There's a perhaps too-short length limitation -- 16 characters -- on the serial number in the classic GUI, too.

skogs

Nexus package upgrade today _1 version seems to have allowed my hardware to run correctly. I did not need to bring it down and put a fake serial or anything into the coreboot system.

It is different. I don't like change.

It seems pretty functional though.

kikuyu

@skogs Same for me. I updated the Nexus pkg and my box is running without error concerning the serial number.
Good .

JeGr

@skogs said in Error on Third-Party HW: "Nexus cannot be licensed":

Nexus package upgrade today _1 version seems to have allowed my hardware to run correctly. I did not need to bring it down and put a fake serial or anything into the coreboot system.

It is different. I don't like change.

It seems pretty functional though.

@marcosm Is there a possibility to manually install that _1 update to get the updated nexus and pkg stuff on my box? My hardware was doing fine until updating to 26.07 and now the normal GUI shows "all fine, no updates". Only checking on the console and Nexus I still got license and certificate errors and the box won't update anything, won't install packages etc. as it can't access the repositories anymore:

pfSense-repoc-static: zuul_repo_fetch: Failed to read the repository data (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10416 d83e67bd5fe056aefdcb54988f3334f4


>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
1000E0008E020000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-main/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.c:2125:

As described above, that is the same hardware box running a C2558 Atom that didn't had any problems up until now with the weird serial number checking.

Cheers

stephenw10

Mmm, that's unrelated to the serial/nexus issue AFAIK. But it can be fixed by removing the zuul CA like:
https://forum.netgate.com/topic/201408/getting-the-following-error-when-trying-to-update-unbound-package-in-ssh-or-command-in-gui

JeGr

@stephenw10 said in Error on Third-Party HW: "Nexus cannot be licensed":

Mmm, that's unrelated to the serial/nexus issue AFAIK. But it can be fixed by removing the zuul CA like:
https://forum.netgate.com/topic/201408/getting-the-following-error-when-trying-to-update-unbound-package-in-ssh-or-command-in-gui

The commands didn't seem to work for me. After the pkg-updates at the end, it still quits with bad requests and certificate verification faults

An update from console still triggers this:

pfSense-repoc-static: zuul_license_check: Failed to check the license (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10405 1390431b2cf063b9fe04cf91d357307d device fingerprint not recognized


pfSense-repoc-static: zuul_license_fetch: Failed to check the license (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10405 52770b76e62725a769309a625bbabf38 device fingerprint not recognized


pfSense-repoc-static: zuul_repo_fetch: Failed to read the repository data (1).
pfSense-repoc-static: server returned error response: 400 Bad Request
10416 bc53770c662be99fce698de0d1d62e79


>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
1000A05AEE200000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-main/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
1000A05AEE200000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-main/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /C=US/ST=Texas/L=Austin/O=Rubicon Communications, LLC (Netgate)/OU=pfSense Plus/CN=pfsense-plus-pkg01.atx.netgate.com
...
many errors more

JeGr

@stephenw10 @marcosm

Also I did double-check that the zuul CA was definetly deleted and seemingly recreated. But the error still persists.

JeGr

OK manually resetting and rebuilding the nexus license with help from @marcosm finally got things back in order. After stopping the service, resetting and deleting the license and removing it from the database tables, too, it finally got recreated completely and afterwards pkg finally got working again.