Hi everyone, I have tried walking through this a few times and I'm stuck. In fairness I'm a beginner and its not looking good. lol
I cant get the published .sig file for the 26.7 vga-amd64 image to verify against the published .img.bz2 and .pub files, using the exact verification process documented at docs.opnsense.org/manual/install.html.
I have tried downloading fresh files from multiple mirrors, as well as on two different systems.
these are the files i have grabbed:
OPNsense-26.7-vga-amd64.img.bz2
OPNsense-26.7-vga-amd64.img.sig
OPNsense-26.7.pub
OPNsense-26.7-checksums-amd64.sha256
i downloaded the newest version of SSL:
OpenSSL 4.0.2 25 Aug 2026
just get this
Verification failure
64250000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto\evp\evp_fetch.c:376:Global default library context, Algorithm (dgst : 0), Properties (<null>)
64250000:error:02000068:rsa routines:ossl_rsa_verify:bad signature:crypto\rsa\rsa_sign.c:441:
64250000:error:1C880004:Provider routines:rsa_verify_directly:RSA lib:providers\implementations\signature\rsa_sig.c:1071:
Any help or ideas on what to try would be appreciated.
Thanks!
Please post the exact commands you run (up to the one that failed), one by one. And include what operation system you used.
The signature is for the uncompressed image. The checksum is for the compressed image.
Cheers,
Franco