Are RSA-7680 Trust store certificates still supported?

[gromit]

I seem to be having problems with 7680-bit RSA certificates now, so I am wondering if that length of key is still supported.

I noticed recently that my ACME certificate was no longer being renewed---at least in the Trust store.  The ACME logs would show a successful renewal via LetsEncrypt, but it would not update the certificate in the Trust store that eventually expired (July 11, 2026, shortly after which this came to my attention).

I was running 26.1.11 when this came to my notice, so today I upgraded to 26.7.1_1 in the hope this might "fix" whatever problems I was having with ACME and the Trust store.  It didn't.

I removed the ACME plugin; reset its configuration; deleted related certificates from the Trust store; and even deleted ACME files and directories from the file system before reinstalling the ACME plugin and setting up a new ACME config again.  This still didn't work, but the ACME part seemed to work (like before) inasmuch as it would obtain and download a certificate---just not import it into the Trust store.

I've noticed a new message in System -> Firmware -> Reporter since trying to get a new ACME certificate today.  Here are the PHP Errors:

Code Select Expand

[23-Jul-2026 18:09:38 Etc/UTC] PHP Fatal error:  Uncaught OPNsense\Base\ValidationException: [OPNsense\Trust\Ca:ca.fe3168a9-3e2e-49c3-a581-be1edfef2952.key_type] Option [] not in list.{7680}
[OPNsense\Trust\Ca:ca.ec78b5a8-75a8-4758-988a-87a22d4a9fc3.key_type] Option [] not in list.{7680}
 in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(193): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(175): OPNsense\AcmeClient\LeCertificate->import(true)
#2 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(198): main()
#3 {main}
  thrown in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 822
[23-Jul-2026 19:21:25 Etc/UTC] PHP Fatal error:  Uncaught OPNsense\Base\ValidationException: [OPNsense\Trust\Ca:ca.fe3168a9-3e2e-49c3-a581-be1edfef2952.key_type] Option [] not in list.{7680}
[OPNsense\Trust\Ca:ca.ec78b5a8-75a8-4758-988a-87a22d4a9fc3.key_type] Option [] not in list.{7680}
 in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php:822
Stack trace:
#0 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(193): OPNsense\Base\BaseModel->serializeToConfig()
#1 /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php(381): OPNsense\AcmeClient\LeCertificate->import(true)
#2 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(164): OPNsense\AcmeClient\LeCertificate->issue()
#3 /usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php(198): main()
#4 {main}
  thrown in /usr/local/opnsense/mvc/app/models/OPNsense/Base/BaseModel.php on line 822
The "Option [] not in list.{7680}" made me wonder whether it was referring to a RSA-7680 certificate.  My OPNsense installation is rather old, and I do have two internal certificate authorities in the Trust -> Authorities section, created in 2018, that are RSA-7680, at least according to the certificate info ("Public-Key: (7680 bit)").  (The ACME certificate I am obtaining has an ec-384 key length.)

Is that type of 7680-bit certificate supported any more?  When I looked at the key types when creating a new CA, 7680-bit is not listed as an option (it goes RSA-4096 and then RSA-8192).

I'm wondering whether this exception being thrown is what is causing the import into the Trust store to fail.

Cheers,

Paul.

[franco]

Hi Paul,

I don't think we ever supported 7680. Theoretically it would be easy to add so the question is if OpenSSL/PHP/Phpseclib cope with it.


Cheers,
Franco

[gromit]

Those two internal CAs were created quite a while ago (2018)---long enough ago that I don't remember whether they were created in OPNsense or created externally and imported into OPNsense.  It sounds from what you are saying that the latter might have happened, though it looks like the list of key and digest types is shorter now than I remember in the dialogues for creating certificates.

Is my hypothesis that this exception is preventing the import of the ACME certificate into the Trust store plausible?  From the stack trace, it looks like it is being provoked by "OPNsense\AcmeClient\LeCertificate->import(true)".

If so, it looks like the ACME plugin won't work for me so long as these non-validating CAs remain in the Trust store?  (Or, until they can be validated.)

Cheers,

Paul.

[franco]

Hi Paul,

# opnsense-patch https://github.com/opnsense/core/commit/5c7830d

Seems to produce certificates and CAs for me so this will certainly help you with your validation issue.


Cheers,
Franco

[gromit]

Thank you, Franco.  After applying that opnsense-patch I was able to import my ACME certificate into the Trust store once again.  It looks like it has solved my problem.

Cheers,

Paul.

[franco]

Good, we'll add the patch to 26.7.2.


Cheers,
Franco