Backstory:
I use CACert as my certificate authority and have for years.
Up until the current certificate renewal cycle (e.g. annually), this has been pretty easy to manage.
- drop the CA Root /Class 3 certs in `/usr/local/etc/ssl/certs`
- run `certctl rehash`
- install or update the CA certs in "System -> Trust -> Authorities"
- install or update the server cert in "System -> Trust -> Certificates"
- restart the server
With a fresh-off-the-electronic-press renewed certificate for 2026, I'm now getting a "missing CA key" message on trying to either update the in-place certificate and/or import the certificate /key pair as a new certificate.
Via command line on the box, the renewed cert validates - it's just in the WebUI that it hurks.
# openssl verify -show_chain .\charon-2026.pem
charon-2026.pem: OK
Chain:
depth=0: CN=charon.lan.null-route.us (untrusted)
depth=1: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
depth=2: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.orgI'm sure I missed something simple, but what???
Class 3 is the intermediate, issuing CA
You're missing the root CA seen at depth:2
Do you mean:
# openssl x509 -noout -subject -in /usr/local/share/certs/rootX0F.crt
subject=O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.organd
# openssl x509 -noout -subject -in /usr/local/share/certs/CACert_Class3Root_x14E228.crt
subject=O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root?
It looks like the CA Root is present and OpenSSL knows about it (existing soon-to-expire server cert):
# hostname
charon.lan.null-route.us
# openssl s_client -connect charon.lan.null-route.us:443 | grep -i -e verify
Connecting to 2001:579:4c:2700:6662:66ff:fe25:7341
depth=2 O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.org
verify return:1
depth=1 O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
verify return:1
depth=0 CN=charon.lan.null-route.us
verify return:1
Verify return code: 0 (ok)
Cross-checking to make sure that the current certs from CACert are loaded:
# certctl -v rehash
[snipped for readability]
found /usr/local/share/certs/CACert_Class3Root_x14E228.crt
590d426f: CAcert Class 3 Root
found /usr/local/share/certs/ca-root-opnsense-1.crt
590d426f: duplicate
found /usr/local/share/certs/rootX0F.crt
99d0fa06: CA Cert Signing Authority
found /usr/local/share/certs/ca-root-opnsense-0.crt
99d0fa06: duplicate
and
# certctl -v list
localbase: /usr/local
destdir:
distbase:
unprivileged: false
verbose: true
[snipped]
found /etc/ssl/certs/590d426f.0
590d426f: CAcert Class 3 Root
found /etc/ssl/certs/99d0fa06.0
99d0fa06: CA Cert Signing Authority
[snipped]
590d426f.0 CAcert Class 3 Root
99d0fa06.0 CA Cert Signing Authority
Yeah then I'm not sure what's going on, sorry.
You couldn't possibly have the CA pk unless you were that CA...so I'm not sure what's triggering that error message about the CA key
Needing a CA key suggests that you're trying to create a new cert issued by a CA internal to OPNsense. Maybe a silly question, but you are trying to "Import an existing Certificate", not "Create an internal Certificate", right?
Correct.
I've tried both "Import an existing Certificate" as well as editing the in-place (active) certificate to update the certificate data (aka "Reissue and replace").
I'm getting the same error trying to renew the GUI self-signed cert.
The release notes for 26.7 mentioned the upgrade of openssl to 3.5 and possible issues, maybe related to this and the other thread (https://forum.opnsense.org/index.php?topic=52645.0) about exporting OpenVPN profiles?
hi there,
im the guy with the "exporting OpenVPN profiles"-Problem.
FYI: i had to downgrade to 26.1.11_10 to make this working again.
Upgraded to OpnSense v26.7.2.
Attempted to update or replace the expiring certificate using:
Reissue and replace
Import Existing Certificate (Signed by CA)
Import Existing Certificate
and I generated a new Certificate, using a CSR from the built-in OpnSense Certificate Request generator, at both CA Cert and SSL.com.
Those certificates also failed with the same "missing CA key" error popup.
Upgrade to 26.7.2_2
No change. Still unable to add or update SSL certificates via the WebUI.
Is there a way to do this via Command Line?
Now that my certificate has expired, the WebUI is defunct.
Is there a way to disable HTTPS via the CLI so I can admin my firewalls?
configctl webgui restart renew