Expired certificate on update
-
I was trying to update and I found an expired certificate (netgate side) preventing pkg-static update -f from working:
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R13
verify return:1
depth=0 CN = files.pfsense.org
verify error:num=10:certificate has expired
notAfter=Jun 28 07:30:30 2026 GMT
verify return:1
depth=0 CN = files.pfsense.org
notAfter=Jun 28 07:30:30 2026 GMT
verify return:1
CONNECTED(00000003)Certificate chain
0 s:CN = files.pfsense.org
i:C = US, O = Let's Encrypt, CN = R13 -
@unsichtbarre how/where are you seeing that - I don't show that cert expired for files.pfsense.org
-
[2.7.0-RELEASE][admin@]/root: openssl s_client -connect pkg01-atx.netgate.com:443 -servername pkg.pfsense.org -showcerts </dev/null |& head -40
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R13
verify return:1
depth=0 CN = files.pfsense.org
verify error:num=10:certificate has expired
notAfter=Jun 28 07:30:30 2026 GMT
verify return:1
depth=0 CN = files.pfsense.org
notAfter=Jun 28 07:30:30 2026 GMT
verify return:1
CONNECTED(00000003)Certificate chain
0 s:CN = files.pfsense.org
i:C = US, O = Let's Encrypt, CN = R13 -
More clarity: ```
[2.7.0-RELEASE][admin@]/root: drill pkg.pfsense.org
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 22256
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;; pkg.pfsense.org. IN A;; ANSWER SECTION:
;; AUTHORITY SECTION:
pfsense.org. 1800 IN SOA ns1.netgate.com. admin.netgate.com. 2026080601 3600 3600 604800 3600;; ADDITIONAL SECTION:
;; Query time: 51 msec
;; SERVER: 8.8.4.4
;; WHEN: Fri Aug 7 12:40:09 2026
;; MSG SIZE rcvd: 90
[2.7.0-RELEASE][admin@]/root: drill files.pfsense.org
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 10215
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; files.pfsense.org. IN A;; ANSWER SECTION:
files.pfsense.org. 133 IN A 208.123.73.209
files.pfsense.org. 133 IN A 208.123.73.207;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 14 msec
;; SERVER: 8.8.8.8
;; WHEN: Fri Aug 7 12:40:20 2026
;; MSG SIZE rcvd: 67
[2.7.0-RELEASE][admin@]/root: echo | openssl s_client -connect 208.123.73.207:443 -servername pkg.pfsense.org | openssl x509 -noout -subject -dates
depth=3 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=2 C = US, O = ISRG, CN = Root YR
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = YR2
verify return:1
depth=0 CN = files.pfsense.org
verify return:1
DONE
subject=CN = files.pfsense.org
notBefore=May 29 19:16:54 2026 GMT
notAfter=Aug 27 19:16:53 2026 GMT
[2.7.0-RELEASE][admin@]/root: echo | openssl s_client -connect 208.123.73.209:443 -servername pkg.pfsense.org | openssl x509 -noout -subject -dates
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R13
verify return:1
depth=0 CN = files.pfsense.org
verify error:num=10:certificate has expired
notAfter=Jun 28 07:30:30 2026 GMT
verify return:1
depth=0 CN = files.pfsense.org
notAfter=Jun 28 07:30:30 2026 GMT
verify return:1
DONE
subject=CN = files.pfsense.org
notBefore=Mar 30 07:30:31 2026 GMT
notAfter=Jun 28 07:30:30 2026 GMT
[2.7.0-RELEASE][admin@]/root: -
@unsichtbarre said in Expired certificate on update:
echo | openssl s_client -connect 208.123.73.207:443 -servername pkg.pfsense.org | openssl x509 -noout -subject -dates
very weird I don't get that
[26.03.1-RELEASE][admin@sg4860.home.arpa]/root: echo | openssl s_client -connect 208.123.73.207:443 -servername pkg.pfsense.org | openssl x509 -noout -subject -dates Connecting to 208.123.73.207 depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X1 verify return:1 depth=2 C=US, O=ISRG, CN=Root YR verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YR2 verify return:1 depth=0 CN=files.pfsense.org verify return:1 DONE subject=CN=files.pfsense.org notBefore=May 29 19:16:54 2026 GMT notAfter=Aug 27 19:16:53 2026 GMT [26.03.1-RELEASE][admin@sg4860.home.arpa]/root:Oh its only on the .209 one
[26.03.1-RELEASE][admin@sg4860.home.arpa]/root: echo | openssl s_client -connect 208.123.73.209:443 -servername pkg.pfsense.org | openssl x509 -noout -subject -dates Connecting to 208.123.73.209 depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1 verify return:1 depth=1 C=US, O=Let's Encrypt, CN=R13 verify return:1 depth=0 CN=files.pfsense.org verify error:num=10:certificate has expired notAfter=Jun 28 07:30:30 2026 GMT verify return:1 depth=0 CN=files.pfsense.org notAfter=Jun 28 07:30:30 2026 GMT verify return:1 DONE subject=CN=files.pfsense.org notBefore=Mar 30 07:30:31 2026 GMT notAfter=Jun 28 07:30:30 2026 GMT [26.03.1-RELEASE][admin@sg4860.home.arpa]/root:Lets ping @stephenw10 he can prob get someone to look into it
Prob some auto update failed to update.. Why not a fan of such stuff ;)
-
Pinged our guys.
-
Though it looks good to me now. Anyone still seeing a problem?
-
@stephenw10 looks good now
echo | openssl s_client -connect 208.123.73.209:443 -servername pkg.pfsense.org | openssl x509 -noout -subject -dates Connecting to 208.123.73.209 depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X1 verify return:1 depth=2 C=US, O=ISRG, CN=Root YR verify return:1 depth=1 C=US, O=Let's Encrypt, CN=YR2 verify return:1 depth=0 CN=files.pfsense.org verify return:1 DONE subject=CN=files.pfsense.org notBefore=May 29 19:16:54 2026 GMT notAfter=Aug 27 19:16:53 2026 GMT
Privacy Policy · Cookie Policy