Hi everyone,
recently, the update mechanism for pushing SSL certificates to OPNCentral-managed hosts from the main host seems to have stopped working.
Unfortunately, I don't precisely know which versions broke the functionality, however it is not working at least on the latest 26.4.1 patch.
The host is configured as following: (https://i.ibb.co/m5QMJbtK/Pasted-image-Edit.png)
This is the certificate configured on the provisioning: (https://i.ibb.co/yFH7sQyG/Pasted-image-2-Edit.png)
The provisioning for Web GUI is apparently complete (no new data): (https://i.ibb.co/R4zzCkBz/image.png)
However, the certificate is not set in the Web GUI config of the Host, and is nowhere to be found in the Certificate store: (https://i.ibb.co/GvRcZQ4h/image.png)
(https://i.ibb.co/VYg39wt7/image.png)
Both firewalls were restarted and updated, and I manually tried to start the provisioning, but nothing happens.
No related log lines / errors are present in the system log of either firewalls.
Has anyone experienced the same issue recently?
---
Versions: Both firewalls are running
OPNsense 26.4.1-amd64
FreeBSD 14.3-RELEASE-p15
OpenSSL 3.0.21
with plugin versions
os-OPNBEcore 1.8_2
os-OPNcentral 1.12_2
Hello,
I am not sure if this is related, since the ACME client (issuing/renewing) and the OPNCentral cert push (distribution) are really separate paths – but in case it helps: after the last two updates I had ACME client trouble too (different DNS provider), which I could clear with a ,,Reset ACME Client" + ,,Renew Certificate". Probably not related to the push mechanism you're describing, though.
Cheers,
Marco
We checked the feature internally and it worked fine (minus the ACME-client based cert use). Not sure what's going on. The other end indicates the config is the same... perhaps the wrong node pointed to?
Cheers,
Franco
Hello,
okay, that is indeed strange. We double checked again all the values, and everything seems correct, however it simply does not want to push.
This is the case for all of our 8 firewalls, so the other sites also do not receive a valid certificate.
Is there maybe an internal log / view of the sync process, such that we could debug the issue further?
Thanks in advance
Can you try creating a self signed certificate and push that to one of the affected opnsense firewalls? That could rule out its a generic problem or related directly to the ACME client.
Sorry for the late reply,
no matter which certificate is configured (even a new self-signed one), the push is not working at all, but the Provisioning still displays green.
Due to lack of other reports it's unclear where the problem is. The best way to find out what is wrong would be commercial support. A remote session often makes this straight-forward.
Cheers,
Franco
Hello everyone,
I found the issue finally, it seems that the WebUI class is reported as up-to-date if the values only differ in the selected certificate ID.
Since the cert ID is different and it is not found on the target host, it is therefore not considered "different", so it shows up-to-date.
If the certificate exists but contains different values, it is considered to be different.
To fix it for my case, the solution was to set some unrelated value in the WebGUI configuration of the target to a different value, and then resynchronizing.
Maybe there is a bug in the logic of OPNCentral related to certificate comparison?
Anyways, thanks for the help