System: Trust: Certificates: Show certificate info

[combsbj]

OPNsense 24.7.8-amd64
FreeBSD 14.1-RELEASE-p6
OpenSSL 3.0.15

After generating a new cert using ACME Client service, it is immediately available in /var/etc/acme-client via SSH/SCP. It is also immediately listed in the trust certificate web ui. However, the info and download button will not work for hours, even after restarting all services.

Is this expected?
Is there a recommended way to download a cert from the web ui after generating in from ACME client?

[mgeoffriau]

I'm seeing the same thing. I went to the certificates page because I was intending to modify my cipher list and wanted to double check what how all the existing certs were keyed.

However, the "show certificate info" buttons don't do anything, nor do the "Download" buttons.

Versions
OPNsense 24.7.8-amd64
FreeBSD 14.1-RELEASE-p6
OpenSSL 3.0.15

[mgeoffriau]

Hmm, so I upgraded a separate OPNsense VM I had on hand to 24.7.9 and I can still view info and download a certificate. So if it's a legitimate bug, it's not universal. The only major difference I can see is that on the VM, I have no additional certificates, only the OPNsense GUI cert. On the affected baremetal install, I have a CA along with a handful of server certificates issued from it, plus a few Let's Encrypt certificates.

[newsense]

What theme are you using ?

Try on the default OPNsense one.

[mgeoffriau]

I only have one theme listed called "opnsense", and that what it is set to.

[mirobiala]

For me it`s the same. Is there any progress on this, or workaround may be?

[newsense]

Works fine for me with the default OPNsense theme, in Certificates and Authorities sections.

Have you tried a different browser ?

[mirobiala]

Works fine for me with the default OPNsense theme, in Certificates and Authorities sections.

Have you tried a different browser ?

Yes @newsense, I did and the result is the same. But if it was a browser issue, all certificates would be affected, not just the last generated ones.
Am I right?

Update : It might be a permissions issue. In /var/etc/acme-client/certs I found that the last acme certificates are created with different permissions compared to the older ones. The older certificates folders have drwxr-x---, but the last ones drwx------ and the keys inside: from -rwxr-x--- to -rw-------.

[newsense]

For the permissions issue you may want to open a Github ticket in opnsense/plugins

[mirobiala]

For the permissions issue you may want to open a Github ticket in opnsense/plugins

Attaching it to existing ticket : Link ...