Messages

I have the same problem but in core: I created some certificates and added them to a revocation-list. Denn I deleted CA and CRL. Now I have certs in use which cant't be deleted:

Code Select Expand

Item in use by
cert - <CN> {crl.cert}


Code Select Expand

find / -name crl.cert returned nothing.

I can confirm, that with 22.7.10_2 it ist working again.

I think, it would be better to switch to newer key format as suggestet here: https://github.com/opnsense/plugins/commit/de660623ed

then change md5 with sha in next step.

@franco: If you need tests-keys and setup I can help out.

Maybe you problem is

Firewall: Settings: Advanced: Disable reply-to

try to activate it.

It is an Upstream-Bug from bind:

https://gitlab.isc.org/isc-projects/bind9/-/issues/3668

maybe it helps: this one is working to:

/usr/local/bin/nsupdate -y hmac-md5:KEYNAME:SECRET /var/etc/nsupdatecmds0

The plugin is not working any more?!

when I try myself I get the following error:

/usr/local/bin/nsupdate -k /var/etc/K0lod-01.dyn-ip.info.+157+00000.key /var/etc/nsupdatecmds0

09-Dec-2022 12:03:31.836 /var/etc/K0<DOMAIN>.+157+00000.key:1: unknown option <DOMAIN>.'
09-Dec-2022 12:03:31.838 /var/etc/K0<DOMAIN>.+157+00000.key:2: unexpected token near end of file
could not read key from /var/etc/K0<DOMAIN>.+157+00000.{private,key}: unexpected token
update failed: REFUSED

when I manually create a keyfile like it is stored in bind it is working:

key "KEYNAME" {
        algorithm hmac-md5;
        secret "SECRET";
};

I now have the problem with 21.1.6.
FreeBSD-12.x and pfSense are working fine.
I have a OpnSense-Cluster on two Dell R630 on 10GB-Links. Sometimes, both VMs freezed within one hour :-(

Tried all combinations of +/- lro,  +/- tso, +/- (rxcsum, txcsum) and vlanhwtag: Nothing worked.

Any new idea on this?

Hi,

maybe there is a bug in creating a CA:
there should be a
Certificate:
    Signature Algorithm:
        X509v3 extensions:
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign

or something like this.

When I create a CA in opnSense, there is no "X509v3 Key Usage".