Updating firmware fails due to certificate error

[sewi]

Hey there -

When trying to update my opnSense installation (OPNsense 20.7-amd64), I get certificate errors:

Code: [Select]

# pkg update
Updating OPNsense repository catalogue...
SSL certificate subject doesn't match host opn.sense.nz
SSL certificate subject doesn't match host opn.sense.nz
SSL certificate subject doesn't match host opn.sense.nz
pkg: https://opn.sense.nz/FreeBSD:12:amd64/20.7/latest/meta.txz: Authentication error

Here's a curl to that URI:

Code: [Select]

# curl https://opn.sense.nz/FreeBSD:12:amd64/20.7/latest/packagesite.txz
curl: (60) SSL: no alternative certificate subject name matches target host name 'opn.sense.nz'
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

When opening https://opn.sense.nz I get a certificate issued to cloud.computerfritze.net (see attached file), running a NextCloud installation, so the certificate rejection is legit.

Code: [Select]

# host opn.sense.nz
opn.sense.nz has address 85.214.164.108
opn.sense.nz has address 85.214.164.111
opn.sense.nz has address 85.214.164.113
opn.sense.nz has address 85.214.164.110
opn.sense.nz has address 85.214.163.76
opn.sense.nz has address 85.215.87.199
opn.sense.nz has IPv6 address 2a01:238:42d8:f300:8b23:ec47:1e30:aa9c
opn.sense.nz has IPv6 address 2a01:238:43e2:2d00:315c:85b7:ed77:1ae5
opn.sense.nz has IPv6 address 2a01:238:4363:4a00:ea69:e1e:6281:95fe
opn.sense.nz has IPv6 address 2a01:238:427b:8e00:81ca:d012:b06e:f0fd
opn.sense.nz has IPv6 address 2a01:238:4302:1d00:22d2:99da:2007:6f99
opn.sense.nz has IPv6 address 2a01:238:4215:c00:fca0:f2ae:3d66:3e7f
# host cloud.computerfritze.net
cloud.computerfritze.net has address 85.214.164.108
cloud.computerfritze.net mail is handled by 5 smtpin.rzone.de.

I can replicate that in the company network, as well as the home network, both using the Austrian A1 provider.
Nameservers are 8.8.8.8 and 8.8.4.4.

Any ideas?
Any ideas?

[chemlud]

Hello to OPNsense!

Which update server have you configured? I don't see any

https :///opn.sense.nz

or

https :///curl.haxx.se

here.

These servers don't look like legitimate update servers...

[sewi]

Hi,

opn.sense.nz was what was configured by default (curl.haxx.se appears to be the official website of curl).
If I set it to anything else (currently using ServerBase AG in Zurich), updating works.

In the attachment is what my firmware page suggests (note the opn.sense.nz entry). Frankfurt is the closest location, so I picked that mirror. I haven't changed anything else about the updates, as far as I can remember.

I installed opnSense from the "OPNsense-20.7-OpenSSL-dvd-amd64.iso.bz2" file, downloaded on Aug 21, 2020 8:38 CEST (SHA1: 98 56 39 c4 5c e4 1e 8d 5a f0 2b 9b 25 63 39 b5 6e d9 f4 7a).