Messages

Hello folks.

The guys at Plex Media Server decided to ban all Hetzner IP's because that will shutdown piracy for sure  ::)
Well, to work around this ban, I want my VM at Hetzner to talk to the Public using the Public IP of my Home.
I'll attach a Diagram to show what I am looking for.

I have a working WireGuard Tunnel between Hetzner and my Home.
I'm just trying to figure out how to get the Traffic to the other Site and *then* to the Internet.
Outbound NAT, Routing, both?

Using the APN you posted, I got a public IP and now I see incoming UDP packets, amazing.
The Tunnel still doesn't initiate but I that is probably something else, never tried the new 23.1 setup before.

Hi,

i recently moved and my DSL is not ready yet.
I have an unlimited telekom business SIM and using an Teltonika TRB500 gateway in bridge mode.
I get a CGNAT IP at my WAN interface in OPNsense.

Before I used an VTI Tunnel and it worked great, but I had fiber and an (not offcially but never changed) static IP on my client side.
Now I need to use the cellular connection behind CGNAT as client.
I read this will work when the server only listens to connections and my client side initiates the tunnel.

What happens is, the server receives packets, and tries to send one back.
The one that is sent back never reaches the client and so the tunnel times out.

I really don't know what could be messing up right now, the client never sees any incoming traffic whatsoever from the server.

I'll post my configs tomorrow when I'm at a real computer... mobile right now.
Maybe someone can find culprit with me, many thanks!

The certificate chain of pkg.opnsense.org changed recently.
They are now using a Sectigo Wildcard Certificate, so I'm wondering if you still have these issues.

OpenSSL Log:
openssl s_client -showcerts -connect pkg.opnsense.org:443


CONNECTED(00000003)
depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
verify return:1
depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
verify return:1
depth=0 CN = *.opnsense.org
verify return:1
---
Certificate chain
0 s:CN = *.opnsense.org
   i:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIGMzCCBRugAwIBAgIRAKql/zLP5nCsBkX7C2AJZVQwDQYJKoZIhvcNAQELBQAw
gY8xCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UE
AxMuU2VjdGlnbyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD
QTAeFw0yMDAxMjIwMDAwMDBaFw0yMjAxMjkyMzU5NTlaMBkxFzAVBgNVBAMMDiou
b3Buc2Vuc2Uub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0uOP
ZAoPfLMLew26Jbck9pppvQhHkWlXiz1pOV+YP446zMLJfJhoOOSSb74kf3vdXLdb
vM1Nxmdu2+G409pjfj+KUWEIN6eqZzRQ/ti4H9Xx2utuuENJ4kOrEFLWu+GH9Kfk
A36Pig20/M9PUvam6FB2y/oS3eOioCl9BkitfJsv5TC7PdaPYx5jqUmWP7Exe6pE
vvxPFU6lHlN6eGElW5BZClFtsQdt71SMOEK+fVpuKtSCpmkMxZR7VU9N50gp4u26
CWDEOSdAZEazDZCLMqLLeGr4fI0bxAp2+tjqtPccuywQzyoxTgjjhfvOY5fDHx03
FIQJ8fvSZDtyfcw/KQIDAQABo4IC/TCCAvkwHwYDVR0jBBgwFoAUjYxexFStiuF3
6Zv5mwXhuAGNYeEwHQYDVR0OBBYEFI5agxXurWZ4TCnFaLt9BJVrE3fwMA4GA1Ud
DwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
BgEFBQcDAjBJBgNVHSAEQjBAMDQGCysGAQQBsjEBAgIHMCUwIwYIKwYBBQUHAgEW
F2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAECATCBhAYIKwYBBQUHAQEE
eDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29S
U0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCMGCCsGAQUFBzAB
hhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAnBgNVHREEIDAegg4qLm9wbnNlbnNl
Lm9yZ4IMb3Buc2Vuc2Uub3JnMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdgBG
pVXrdfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAW/OOTUcAAAEAwBHMEUC
IQCqpQuVnJWhzFFonCzybDP+Dfm3VUQJ/OiLP7a9I3eO7AIgP0dyeUsY0SBavzy1
l+uXu/xbcumKSKz4MbYBI0S9TUkAdgBvU3asMfAxGdiZAKRRFf93FRwR2QLBACkG
jbIImjfZEwAAAW/OOTVpAAAEAwBHMEUCIQCv5mW+Y/ptu+eU4mrA/BYg8AzH2ex3
kSy+FBXQE9K/GAIgJJOvwRuu1YP24A++Peis50x4H80dG92gYbX7oC76KUkAdQAi
RUUHWVUkVpY/oS/x922G4CMmY63AS39dxoNcbuIPAgAAAW/OOTULAAAEAwBGMEQC
IBSdWWClPXY7OPNOLkGIdPPrIXlX5cWq0j+cF2qgd/6BAiBX9JHarLhnS6ApPfYm
22nR2s3PILUQFZYCluVdBkJV4jANBgkqhkiG9w0BAQsFAAOCAQEAKftaKWepNIbZ
+1HFSIpucjukG54xlEM+jsOPweVP89P85Oskb5o3PtsiT+Cw2tAgXPiRXdxA1i1E
s5U1VPx7AFDag7SlMU+Te+eG3d206LNTbjZkTRO5KpeagZMaVa+Cq4jzvZx0riue
XTWKdtF/HNXzGXWla8Nx1w8Z9a28ZJSIGhXS0M08Od0RcESDyxiB5YTOQd6Y/TGJ
ZydNocV5piavM0ZQpoKL20ux5K4lcq0c0w+IBu0Jg2SBXMM0aM0LA+lka9QGeuI6
phO9dHuN1yPbSpeQPyyZ1SVzKtIRywb8nnhMBzpb2Z46ADt+ZS+ONQDyXCTbQUE8
YdFGtsVZ4A==
-----END CERTIFICATE-----
1 s:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
   i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
-----BEGIN CERTIFICATE-----
MIIGEzCCA/ugAwIBAgIQfVtRJrR2uhHbdBYLvFMNpzANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTgx
MTAyMDAwMDAwWhcNMzAxMjMxMjM1OTU5WjCBjzELMAkGA1UEBhMCR0IxGzAZBgNV
BAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UE
ChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFJTQSBEb21haW4g
VmFsaWRhdGlvbiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEA1nMz1tc8INAA0hdFuNY+B6I/x0HuMjDJsGz99J/LEpgPLT+N
TQEMgg8Xf2Iu6bhIefsWg06t1zIlk7cHv7lQP6lMw0Aq6Tn/2YHKHxYyQdqAJrkj
eocgHuP/IJo8lURvh3UGkEC0MpMWCRAIIz7S3YcPb11RFGoKacVPAXJpz9OTTG0E
oKMbgn6xmrntxZ7FN3ifmgg0+1YuWMQJDgZkW7w33PGfKGioVrCSo1yfu4iYCBsk
Haswha6vsC6eep3BwEIc4gLw6uBK0u+QDrTBQBbwb4VCSmT3pDCg/r8uoydajotY
uK3DGReEY+1vVv2Dy2A0xHS+5p3b4eTlygxfFQIDAQABo4IBbjCCAWowHwYDVR0j
BBgwFoAUU3m/WqorSs9UgOHYm8Cd8rIDZsswHQYDVR0OBBYEFI2MXsRUrYrhd+mb
+ZsF4bgBjWHhMA4GA1UdDwEB/wQEAwIBhjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
A1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAbBgNVHSAEFDASMAYGBFUdIAAw
CAYGZ4EMAQIBMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0
LmNvbS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2Bggr
BgEFBQcBAQRqMGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNv
bS9VU0VSVHJ1c3RSU0FBZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDov
L29jc3AudXNlcnRydXN0LmNvbTANBgkqhkiG9w0BAQwFAAOCAgEAMr9hvQ5Iw0/H
ukdN+Jx4GQHcEx2Ab/zDcLRSmjEzmldS+zGea6TvVKqJjUAXaPgREHzSyrHxVYbH
7rM2kYb2OVG/Rr8PoLq0935JxCo2F57kaDl6r5ROVm+yezu/Coa9zcV3HAO4OLGi
H19+24rcRki2aArPsrW04jTkZ6k4Zgle0rj8nSg6F0AnwnJOKf0hPHzPE/uWLMUx
RP0T7dWbqWlod3zu4f+k+TY4CFM5ooQ0nBnzvg6s1SQ36yOoeNDT5++SR2RiOSLv
xvcRviKFxmZEJCaOEDKNyJOuB56DPi/Z+fVGjmO+wea03KbNIaiGCpXZLoUmGv38
sbZXQm2V0TP2ORQGgkE49Y9Y3IBbpNV9lXj9p5v//cWoaasm56ekBYdbqbe4oyAL
l6lFhd2zi+WJN44pDfwGF/Y4QA5C5BIG+3vzxhFoYt/jmPQT2BVPi7Fp2RBgvGQq
6jG35LWjOhSbJuMLe/0CjraZwTiXWTb2qHSihrZe68Zk6s+go/lunrotEbaGmAhY
LcmsJWTyXnW0OMGuf1pGg+pRyrbxmRE1a6Vqe8YAsOf4vmSyrcjC8azjUeqkk+B5
yOGBQMkKW+ESPMFgKuOXwIlCypTPRpgSabuY0MLTDXJLR27lk8QyKGOHQ+SwMj4K
00u/I5sUKUErmgQfky3xxzlIPK1aEn8=
-----END CERTIFICATE-----
2 s:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
   i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
-----BEGIN CERTIFICATE-----
MIIF3jCCA8agAwIBAgIQAf1tMPyjylGoG7xkDjUDLTANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0pl
cnNleSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNV
BAMTJVVTRVJUcnVzdCBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAw
MjAxMDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBiDELMAkGA1UEBhMCVVMxEzARBgNV
BAgTCk5ldyBKZXJzZXkxFDASBgNVBAcTC0plcnNleSBDaXR5MR4wHAYDVQQKExVU
aGUgVVNFUlRSVVNUIE5ldHdvcmsxLjAsBgNVBAMTJVVTRVJUcnVzdCBSU0EgQ2Vy
dGlmaWNhdGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
AoICAQCAEmUXNg7D2wiz0KxXDXbtzSfTTK1Qg2HiqiBNCS1kCdzOiZ/MPans9s/B
3PHTsdZ7NygRK0faOca8Ohm0X6a9fZ2jY0K2dvKpOyuR+OJv0OwWIJAJPuLodMkY
tJHUYmTbf6MG8YgYapAiPLz+E/CHFHv25B+O1ORRxhFnRghRy4YUVD+8M/5+bJz/
Fp0YvVGONaanZshyZ9shZrHUm3gDwFA66Mzw3LyeTP6vBZY1H1dat//O+T23LLb2
VN3I5xI6Ta5MirdcmrS3ID3KfyI0rn47aGYBROcBTkZTmzNg95S+UzeQc0PzMsNT
79uq/nROacdrjGCT3sTHDN/hMq7MkztReJVni+49Vv4M0GkPGw/zJSZrM233bkf6
c0Plfg6lZrEpfDKEY1WJxA3Bk1QwGROs0303p+tdOmw1XNtB1xLaqUkL39iAigmT
Yo61Zs8liM2EuLE/pDkP2QKe6xJMlXzzawWpXhaDzLhn4ugTncxbgtNMs+1b/97l
c6wjOy0AvzVVdAlJ2ElYGn+SNuZRkg7zJn0cTRe8yexDJtC/QV9AqURE9JnnV4ee
UB9XVKg+/XRjL7FQZQnmWEIuQxpMtPAlR1n6BB6T1CZGSlCBst6+eLf8ZxXhyVeE
Hg9j1uliutZfVS7qXMYoCAQlObgOK6nyTJccBz8NUvXt7y+CDwIDAQABo0IwQDAd
BgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rIDZsswDgYDVR0PAQH/BAQDAgEGMA8G
A1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAFzUfA3P9wF9QZllDHPF
Up/L+M+ZBn8b2kMVn54CVVeWFPFSPCeHlCjtHzoBN6J2/FNQwISbxmtOuowhT6KO
VWKR82kV2LyI48SqC/3vqOlLVSoGIG1VeCkZ7l8wXEskEVX/JJpuXior7gtNn3/3
ATiUFJVDBwn7YKnuHKsSjKCaXqeYalltiz8I+8jRRa8YFWSQEg9zKC7F4iRO/Fjs
8PRF/iKz6y+O0tlFYQXBl2+odnKPi4w2r78NBc5xjeambx9spnFixdjQg3IM8WcR
iQycE0xyNN+81XHfqnHd4blsjDwSXWXavVcStkNr/+XeTWYRUc+ZruwXtuhxkYze
Sf7dNXGiFSeUHM9h4ya7b6NnJSFd5t0dCy5oGzuCr+yDZ4XUmFF0sbmZgIn/f3gZ
XHlKYC6SQK5MNyosycdiyA5d9zZbyuAlJQG03RoHnHcAP9Dc1ew91Pq7P8yF1m9/
qS3fuQL39ZeatTXaw2ewh0qpKJ4jjv9cJ2vhsE/zB+4ALtRZh8tSQZXq9EfX7mRB
VXyNWQKV3WKdwrnuWih0hKWbt5DHDAff9Yk2dDLWKMGwsAvgnEzDHNb842m1R0aB
L6KCq9NjRHDEjf8tM7qtj3u1cIiuPhnPQCjY/MiQu12ZIvVS5ljFH4gxQ+6IHdfG
jjxDah2nGN59PRbxYvnKkKj9
-----END CERTIFICATE-----
3 s:CN = *.opnsense.org
   i:C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIGMzCCBRugAwIBAgIRAKql/zLP5nCsBkX7C2AJZVQwDQYJKoZIhvcNAQELBQAw
gY8xCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UE
AxMuU2VjdGlnbyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD
QTAeFw0yMDAxMjIwMDAwMDBaFw0yMjAxMjkyMzU5NTlaMBkxFzAVBgNVBAMMDiou
b3Buc2Vuc2Uub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0uOP
ZAoPfLMLew26Jbck9pppvQhHkWlXiz1pOV+YP446zMLJfJhoOOSSb74kf3vdXLdb
vM1Nxmdu2+G409pjfj+KUWEIN6eqZzRQ/ti4H9Xx2utuuENJ4kOrEFLWu+GH9Kfk
A36Pig20/M9PUvam6FB2y/oS3eOioCl9BkitfJsv5TC7PdaPYx5jqUmWP7Exe6pE
vvxPFU6lHlN6eGElW5BZClFtsQdt71SMOEK+fVpuKtSCpmkMxZR7VU9N50gp4u26
CWDEOSdAZEazDZCLMqLLeGr4fI0bxAp2+tjqtPccuywQzyoxTgjjhfvOY5fDHx03
FIQJ8fvSZDtyfcw/KQIDAQABo4IC/TCCAvkwHwYDVR0jBBgwFoAUjYxexFStiuF3
6Zv5mwXhuAGNYeEwHQYDVR0OBBYEFI5agxXurWZ4TCnFaLt9BJVrE3fwMA4GA1Ud
DwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
BgEFBQcDAjBJBgNVHSAEQjBAMDQGCysGAQQBsjEBAgIHMCUwIwYIKwYBBQUHAgEW
F2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAECATCBhAYIKwYBBQUHAQEE
eDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29S
U0FEb21haW5WYWxpZGF0aW9uU2VjdXJlU2VydmVyQ0EuY3J0MCMGCCsGAQUFBzAB
hhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAnBgNVHREEIDAegg4qLm9wbnNlbnNl
Lm9yZ4IMb3Buc2Vuc2Uub3JnMIIBfQYKKwYBBAHWeQIEAgSCAW0EggFpAWcAdgBG
pVXrdfqRIDC1oolp9PN9ESxBdL79SbiFq/L8cP5tRwAAAW/OOTUcAAAEAwBHMEUC
IQCqpQuVnJWhzFFonCzybDP+Dfm3VUQJ/OiLP7a9I3eO7AIgP0dyeUsY0SBavzy1
l+uXu/xbcumKSKz4MbYBI0S9TUkAdgBvU3asMfAxGdiZAKRRFf93FRwR2QLBACkG
jbIImjfZEwAAAW/OOTVpAAAEAwBHMEUCIQCv5mW+Y/ptu+eU4mrA/BYg8AzH2ex3
kSy+FBXQE9K/GAIgJJOvwRuu1YP24A++Peis50x4H80dG92gYbX7oC76KUkAdQAi
RUUHWVUkVpY/oS/x922G4CMmY63AS39dxoNcbuIPAgAAAW/OOTULAAAEAwBGMEQC
IBSdWWClPXY7OPNOLkGIdPPrIXlX5cWq0j+cF2qgd/6BAiBX9JHarLhnS6ApPfYm
22nR2s3PILUQFZYCluVdBkJV4jANBgkqhkiG9w0BAQsFAAOCAQEAKftaKWepNIbZ
+1HFSIpucjukG54xlEM+jsOPweVP89P85Oskb5o3PtsiT+Cw2tAgXPiRXdxA1i1E
s5U1VPx7AFDag7SlMU+Te+eG3d206LNTbjZkTRO5KpeagZMaVa+Cq4jzvZx0riue
XTWKdtF/HNXzGXWla8Nx1w8Z9a28ZJSIGhXS0M08Od0RcESDyxiB5YTOQd6Y/TGJ
ZydNocV5piavM0ZQpoKL20ux5K4lcq0c0w+IBu0Jg2SBXMM0aM0LA+lka9QGeuI6
phO9dHuN1yPbSpeQPyyZ1SVzKtIRywb8nnhMBzpb2Z46ADt+ZS+ONQDyXCTbQUE8
YdFGtsVZ4A==
-----END CERTIFICATE-----
---
Server certificate
subject=CN = *.opnsense.org

issuer=C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 6925 bytes and written 393 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-CHACHA20-POLY1305
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-CHACHA20-POLY1305
    Session-ID: 4FD5FC0C24454A7799ACBEA546CF350C8F2BBF4084410D9E232E0908038D0EF7
    Session-ID-ctx:
    Master-Key: DDCFC5E40810A4CA39C66382D6DB3767BEEE1C41D805AA8DFD8478B5504679CD5BBA0B3C5AEC0D4F3694B23B7A4F5141
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 63 b7 9d 71 18 42 88 62-e5 51 46 c7 db de 4f f3   c..q.B.b.QF...O.
    0010 - b3 0e 27 66 65 03 be a2-35 fd 3f d8 3c fb b8 75   ..'fe...5.?.<..u
    0020 - ae 07 88 96 ab 4f 26 a3-67 cb 4d d5 62 3c e0 74   .....O&.g.M.b<.t
    0030 - 73 a3 47 9f 6f 16 9d 30-44 17 26 d0 24 8c 69 91   s.G.o..0D.&.$.i.
    0040 - 95 c9 94 41 10 33 0f 53-02 e2 37 f2 fb 20 37 1e   ...A.3.S..7.. 7.
    0050 - a1 3f f1 fa 2a 26 3c 72-7e bb 0a 99 1a e5 50 ba   .?..*&<r~.....P.
    0060 - 3c 4b 5c 4c ab f2 ff ac-5c 16 b1 8b 4a c8 9c e1   <K\L....\...J...
    0070 - 50 0b 13 ce ea f3 82 14-8d ac 9c e7 b5 45 7d ee   P............E}.
    0080 - 35 28 df a3 7f f8 31 38-a1 90 3e 54 c0 05 96 2b   5(....18..>T...+
    0090 - 47 b1 48 d4 31 fc 61 19-b9 0d 7c d2 52 b6 5b fe   G.H.1.a...|.R.[.
    00a0 - 71 78 c4 81 ee 8b 18 eb-19 43 b3 ce 4f ad 84 ac   qx.......C..O...
    00b0 - bd fc 01 bd 2d 61 93 e4-e3 62 07 b2 0e b2 22 18   ....-a...b....".
    00c0 - b2 eb f9 fc fb 63 8c 2f-b1 92 35 cc d9 52 1a 6c   .....c./..5..R.l

    Start Time: 1633093579
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---

Renewing their Let's Encrypt Certificate using the new Chain (not the android-compatible cross-signed one) would've worked too, but using a completely different Authority should fix this, too, of course.

Great catch, Tupsi!
Works for me, too!

How to get package updates to work:

- Remove the Let's Encrypt's R3 cert from System -> Trust -> Authorities.
- Add a new Authority Certificate and paste both R3 and ISRG Root X1 into the "Certificate data" field.

"certificate data" should look like this:
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----

Or download them directly from the Let's Encrypt links that I pasted above.

After you updated, re-issue any of your LE certificates (or all of them, to fix your services like HAproxy).
This will load the correct Authority from LE again and replace your just added custom Authority and the system should be good to go again.

For my services that are hit by this issue, I built the following chain that gets delivered by nginx (should work with apache/haproxy etc. too):

wget https://letsencrypt.org/certs/isrgrootx1.pem
wget https://letsencrypt.org/certs/lets-encrypt-r3.pem

cat myCert.pem lets-encrypt-r3.pem isrgrootx1.pem > fullchain.pem

This excludes the old DST root from the chain and clients like openssl / pkg / apt will stop complaining.
The browsers seem to be more tolerant at this point, though.

Nice work!  ;D
Looking forward to run the update.


Now that the old DST Root expired, too, I got a little problem trying to update.
I removed the expired R3 from System -> Trust -> Authorities but this could not fix this issue.
The pkg.opnsense.org page reports the new trustchain, though, IN THE BROWSER! (see openssl below)

OpenSSL (openssl s_client -showcerts -connect pkg.opnsense.org:443) tells me:

CONNECTED(00000003)
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
verify error:num=10:certificate has expired
notAfter=Sep 30 14:01:15 2021 GMT
verify return:1
depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3
notAfter=Sep 30 14:01:15 2021 GMT
verify return:1
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
notAfter=Sep 30 18:14:03 2024 GMT
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
notAfter=Sep 15 16:00:00 2025 GMT
verify return:1
depth=0 CN = pkg.opnsense.org
notAfter=Dec  2 04:35:59 2021 GMT
verify return:1
---
Certificate chain
0 s:CN = pkg.opnsense.org
   i:C = US, O = Let's Encrypt, CN = R3
-----BEGIN CERTIFICATE-----
MIIFJjCCBA6gAwIBAgISAwnrN5poWj6huxamPB7KKObHMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMTA5MDMwNDM2MDBaFw0yMTEyMDIwNDM1NTlaMBsxGTAXBgNVBAMT
EHBrZy5vcG5zZW5zZS5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQDLuegAAsvkP2JKDIinPk32wmxki8rWvWIG/9qWrzhX7uSneOnXsaMGg08FiDRL
V90INKc6ah4tJP62MB9LAaieTy/RvgetWvXJSAHVxI/qdGQbzO519zU45poxqngd
wkyQUOKg9PzQpcMPPFmicxx8ZGVJpeDlXA0RvFpDOcq3ilp1yYRzziVL3P9AmpZj
HpP8hYwtTi6ZgQIFYXfjsSryXOXqAKcwHkMGo8ybXk+CPrvOqztGcyiqyMhqa3Lf
OgLmIFJ2Fwji9GXiYnR0B8ovp18psvI4jio3ueTj34SrcvHm0rpNDK4tmkBZHMy3
MiDzQ0YI94xGZk4tetXhGuMXAgMBAAGjggJLMIICRzAOBgNVHQ8BAf8EBAMCBaAw
HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD
VR0OBBYEFCsV4Qsui4+pEVjC+GwfxyC5EVOWMB8GA1UdIwQYMBaAFBQusxe3WFbL
rlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDov
L3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5jci5v
cmcvMBsGA1UdEQQUMBKCEHBrZy5vcG5zZW5zZS5vcmcwTAYDVR0gBEUwQzAIBgZn
gQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEFBQcCARYaaHR0cDovL2Nwcy5s
ZXRzZW5jcnlwdC5vcmcwggEEBgorBgEEAdZ5AgQCBIH1BIHyAPAAdQB9PvL4j/+I
VWgkwsDKnlKJeSvFDngJfy5ql2iZfiLw1wAAAXuqKBw5AAAEAwBGMEQCIBCHE6jR
njQEF/6It4qSuSPUSpSzNBYjJ90Z6N4RpDu9AiBaAkb5ZA95J/ixPXuaY5+ZjhT9
fMCGJLC6nAflr0P8tQB3AJQgvB6O1Y1siHMfgosiLA3R2k1ebE+UPWHbTi9YTaLC
AAABe6ooHe0AAAQDAEgwRgIhALpNbmfz4/ovnuuBbvBzegPU60r2Kk2PcG6acDLh
tyklAiEAzrIl1bMEAGeV0H7/aUJVfWqobZmOUdFb4Z3xyzvetzIwDQYJKoZIhvcN
AQELBQADggEBAE9YsG8jP9mCotJYPgAKIry2A4fTFReihcATDwhG/iEsLZ3Y2fwE
oCW5C51nAf7GNDzMlI+RCZzLHDRvg+5XJ1rjOWDAmm7DFx1AlsAvvK3jwAuvPA6h
jTIQyQwj1ULsqhbtGqHudrICh+XLs+i/ROJUqC40tM25rgPYDuRyYZ/rrSAy4DQh
tm7bdU/FfHTaPsO0Bb4hD75pOX8vDcD4xFO39XM5zML4zOvD0hKtVOWRzI1Jg0dX
NLpuO3rqwbZiSJfxM0LeGbbNNouM9jxkL3lhr7VsYTJix0mq0clAnUnIjnP2euPm
w3QJTpUmC7BgoxjliF+0UsQe2kqxEOm/5WM=
-----END CERTIFICATE-----
1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----
---
Server certificate
subject=CN = pkg.opnsense.org

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4683 bytes and written 405 bytes
Verification error: certificate has expired
---
New, TLSv1.2, Cipher is ECDHE-RSA-CHACHA20-POLY1305
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-CHACHA20-POLY1305
    Session-ID: CA62F24EAC5A00CEF8CB1CA04B986793D50D784591F2B4B5BDA66DC937388A06
    Session-ID-ctx:
    Master-Key: 1BF31F6E4565CA8B17AAE51E22B2189A724160464B685BB8232E0C2389CECE0252D357A46D3975179048D0A7A3E81BB8
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:
    0000 - 48 3d 03 f0 5e e0 b5 3e-9a aa 90 8b a8 52 52 61   H=..^..>.....RRa
    0010 - 08 cc 87 15 3e 2e 30 76-00 a5 a6 38 8a ea 9a ff   ....>.0v...8....
    0020 - 8c e1 92 f9 0c e0 32 93-c1 f9 1c 4c 2e 83 1e 3d   ......2....L...=
    0030 - 9a 47 ab fe ae 5d 91 f9-47 d7 07 5a 4e 2a 6e 28   .G...]..G..ZN*n(
    0040 - 20 79 6c 2e 94 b9 5d f3-76 b8 a1 e2 f7 be e6 8f    yl...].v.......
    0050 - b2 70 28 d1 d8 be dc 94-4e 05 ab 3a 50 e5 2a 71   .p(.....N..:P.*q
    0060 - 83 bc fa f7 80 f4 68 98-cd 39 9c 84 c8 cf 12 74   ......h..9.....t
    0070 - 10 73 7d ed 06 fb 14 fe-24 10 bb 7a ff 05 2a 20   .s}.....$..z..*
    0080 - f7 d9 9b 18 4c 66 21 3d-0f 6c 62 3e 40 fb b3 dc   ....Lf!=.lb>@...
    0090 - 82 41 cb 55 9e 94 12 c0-ec e7 60 9b 83 c7 26 d9   .A.U......`...&.
    00a0 - 7a 34 d0 07 d2 74 f2 e9-bf a0 10 ed 2d 3a 07 cc   z4...t......-:..
    00b0 - 3a e8 eb 17 4f 94 f0 89-39 36 e1 e3 1f 01 81 05   :...O...96......
    00c0 - 21 af 52 3a 16 8f dc 79-67 4d e8 ef fa 82 dc bf   !.R:...ygM......

    Start Time: 1633017373
    Timeout   : 7200 (sec)
    Verify return code: 10 (certificate has expired)
    Extended master secret: yes
---

Full Log from Package Updater:

***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 21.7.3_1 (amd64/OpenSSL) at Thu Sep 30 17:51:37 CEST 2021
Fetching changelog information, please wait... Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
5472367599616:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
fetch: https://pkg.opnsense.org/FreeBSD:12:amd64/21.7/sets/changelog.txz.sig: Authentication error
Updating OPNsense repository catalogue...
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg: https://pkg.opnsense.org/FreeBSD:12:amd64/21.7/latest/meta.txz: Authentication error
repository OPNsense has no meta file, using default settings
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3
3858323083264:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:1915:
pkg: https://pkg.opnsense.org/FreeBSD:12:amd64/21.7/latest/packagesite.txz: Authentication error
Unable to update repository OPNsense
Error updating repositories!
pkg: Repository OPNsense cannot be opened. 'pkg update' required
Checking integrity... done (0 conflicting)
Your packages are up to date.
***DONE***

Immediately after the old R3 expired, the browsers showed the new chains correctly.
I attached some examples. Also catched a site that still had the old trust chain in use, it breaks as expected.

Good luck y'all!  ;)

Also tried mimugmail's solution on another instance - works too!
So, less hassle than expected, really.

Let's see what burns on friday...  ;D

Tried the patches, they work.
Press the new re-import button (and if required, ymmv) renew your certificates.

I just found the GitHub issue that discusses this exact topic and there seems to be a patch already available!
https://github.com/opnsense/plugins/issues/2550
https://github.com/opnsense/plugins/issues/2550#issuecomment-929380587

So, if it doesn't make it into a publicly available hotfix today, we can at least patch by ourselves and call it a day.
I'll test it and report how / if it worked shortly!

Can confirm this issue.
On Ubuntu 20.04 the trust chain is already broken because ca-certificates removed the old DST Root Ca crt.  :-[
In my case it basically stops APT from working, because I am using an package repository with Let's Encrypt cert on it.
On Debian Buster / Proxmox the old cert is still trusted.

Also, I've found this documentation about the preferred chain: https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain
Sadly the default is (whyever) still the old DST Root, but for future proofing, it'd be great to have the preferred chain configurable via GUI, so we can avoid such last-minute moves.  ;D

Any chance we can get that acme plugin update to OPNsense today, because of the certificate expiry?
I assume all web sites / mailserver and whatnot protected by these certificates will break tonight.

And thank you Matthias for your research on how to workaround this issue, I'll check that out!  :D
And also thanks to franco for your quick response on that issue!  :)

Regards
Felix

[einem]

Hallo zusammen,

Sorry für die späte Antwort.  :-\

Das HA-Konstrukt läuft jetzt seit knapp 4 Wochen und bislang bin ich ziemlich happy damit.
Die Firewalls hängen auch je an einem Switch dran, anstatt über Kreuz.
Demnächst lasse ich mal das 2. Update drüber laufen (20.7.2) - auch der Vorgang lief das 1. Mail vor Ort prima, da bin ich mal optimistisch.

Es gibt ein paar kleinere Wehwehchen sind mir noch aufgefallen, die ich auch zeitnah in weiteren Threads behandeln möchte. Aber nichts Tragisches.

Generell bin ich aber sehr glücklich mit dem jetzigen Setup.

LG
Felix

Ich hatte ein kleines Detail übersehen.

Offenbar wurde damals auf Anfrage hin das Gateway von allen Subnetzen mit Ausnahme von einem - das der alten Firewall - auf die primäre IP der alten Firewall umgestellt.
Jetzt habe ich mal testweise auf einem der Subnetze das Gateway auf die CARP VIP der OPNsenses umstellen lassen.

Die IPs als "IP Alias" in VHID Gruppe 1 (CARP VIP auf WAN) auf dem Interface WAN angelegt und e voila - alles läuft.
Ich habe dann auch das Failover / Failback getestet, mit Erfolg!  ;D

Ich habe mal was ausprobiert.

Die beiden Firewalls hängen mit ihren primären Public IPs und der entsprechenden CARP VIP in einem /29 Subnetz, welches auch das Gateway im selbigen Subnetz liegen hat.
Wenn ich eine der übrigen IPs aus diesem Netz per IP Alias mit VHID 1 (primäre CARP VIP) hinzufüge, flutscht es.

Kann das mit den externen Gateways von Hetzner zusammenhängen?
Wobei ja die CheckPoint demonstriert, dass es technisch möglich ist bzw. sein sollte.