I'm feeling a bit lost here.
I know that CACert is a niche CA provider, but I've been using them for a couple of decades without any issues, once I import their Class 1 and Class 3 Roots.
For some reason, the 26.7 series of OpnSense has so far been unable to use my CACert certificates in any way.
I've tried newly issued certs, renewed certs, old certs, and nothing works.
I also have tried certs from SSL.com, DigiCert and LetsEncrypt.
Also, no dice.
Even after importing the appropriate CA Root certificates from SSL.com and friends in "System -> Trust -> Authorities", on adding a host certificate in "System -> Trust -> Certificates", I get the same error:
"missing CA key"
What can I check on or provide to assist in further debugging?
Is there a config file somewhere that should have a pointer to a bundled PEM file or files and it's corrupt or missing?
Did I maybe miss something in the upgrade to 26.7 that was needed to update the SSL configuration /settings?
Just looking for some help in getting WebUI SSL up and running again.
Are you just trying to replace the web UI certificate with one signed by a publicly available CA? How exactly are you trying to do it? I've been meaning to do this myself (but with my own CA), so I just did it and it seems to have worked fine. Here's what I did:
- Added root CA certificate (not key) in System -> Trust -> Authorities. (I didn't have any intermediates, but I think if you do you need to add them as well.)
- Created an entry in System -> Trust -> Certificates with method "Create a Certificate Signing Request".
- Downloaded the CSR.
- Uploaded the CSR to the CA to create the certificate.
- Edit the entry in System -> Trust -> Certificates to add the certificate signed by the CA (just paste the cert block into the field on the form).
- Set the new certificate in System -> Settings -> Administration and save.