I seem to be having problems with 7680-bit RSA certificates now, so I am wondering if that length of key is still supported.
I noticed recently that my ACME certificate was no longer being renewed---at least in the Trust store. The ACME logs would show a successful renewal via LetsEncrypt, but it would not update the certificate in the Trust store that eventually expired (July 11, 2026, shortly after which this came to my attention).
I was running 26.1.11 when this came to my notice, so today I upgraded to 26.7.1_1 in the hope this might "fix" whatever problems I was having with ACME and the Trust store. It didn't.
I removed the ACME plugin; reset its configuration; deleted related certificates from the Trust store; and even deleted ACME files and directories from the file system before reinstalling the ACME plugin and setting up a new ACME config again. This still didn't work, but the ACME part seemed to work (like before) inasmuch as it would obtain and download a certificate---just not import it into the Trust store.
I've noticed a new message in System -> Firmware -> Reporter since trying to get a new ACME certificate today. Here are the PHP Errors:
[23-Jul-2026 18:09:38 Etc/UTC] PHP Fatal error: Uncaught OPNsense\Base\ValidationException: [OPNsense\Trust\Ca:ca.fe3168a9-3e2e-49c3-a581-be1edfef2952.key_type] Option [] not in list.{7680}
[OPNsense\Trust\Ca:ca.ec78b5a8-75a8-4758-988a-87a22d4a9fc3.key_type] Option [] not in list.{7680}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(193): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(175): OPNsense\AcmeClient\LeCertificate->import(true)
#2 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(198): main()
#3 {main}
thrown in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 822
[23-Jul-2026 19:21:25 Etc/UTC] PHP Fatal error: Uncaught OPNsense\Base\ValidationException: [OPNsense\Trust\Ca:ca.fe3168a9-3e2e-49c3-a581-be1edfef2952.key_type] Option [] not in list.{7680}
[OPNsense\Trust\Ca:ca.ec78b5a8-75a8-4758-988a-87a22d4a9fc3.key_type] Option [] not in list.{7680}
in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(193): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(381): OPNsense\AcmeClient\LeCertificate->import(true)
#2 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(164): OPNsense\AcmeClient\LeCertificate->issue()
#3 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(198): main()
#4 {main}
thrown in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 822
The "Option [] not in list.{7680}" made me wonder whether it was referring to a RSA-7680 certificate. My OPNsense installation is rather old, and I do have two internal certificate authorities in the Trust -> Authorities section, created in 2018, that are RSA-7680, at least according to the certificate info ("Public-Key: (7680 bit)"). (The ACME certificate I am obtaining has an ec-384 key length.)
Is that type of 7680-bit certificate supported any more? When I looked at the key types when creating a new CA, 7680-bit is not listed as an option (it goes RSA-4096 and then RSA-8192).
I'm wondering whether this exception being thrown is what is causing the import into the Trust store to fail.
Cheers,
Paul.