Renewed server certificate failing with "missing CA key".

[Ed V.]

Backstory:

I use CACert as my certificate authority and have for years.

Up until the current certificate renewal cycle (e.g. annually), this has been pretty easy to manage.

• drop the CA Root /Class 3 certs in `/usr/local/etc/ssl/certs`
• run `certctl rehash`
• install or update the CA certs in "System -> Trust -> Authorities"
• install or update the server cert in "System -> Trust -> Certificates"
• restart the server

With a fresh-off-the-electronic-press renewed certificate for 2026, I'm now getting a "missing CA key" message on trying to either update the in-place certificate and/or import the certificate /key pair as a new certificate.

Via command line on the box, the renewed cert validates - it's just in the WebUI that it hurks.

Code Select Expand

# openssl verify -show_chain .\charon-2026.pem
charon-2026.pem: OK
Chain:
depth=0: CN=charon.lan.null-route.us (untrusted)
depth=1: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
depth=2: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.org
I'm sure I missed something simple, but what???

[newsense]

Class 3 is the intermediate, issuing CA

You're missing the root CA seen at depth:2

[Ed V.]

Do you mean:

Code Select Expand

# openssl x509 -noout -subject -in /usr/local/share/certs/rootX0F.crt
subject=O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.organd

Code Select Expand

# openssl x509 -noout -subject -in /usr/local/share/certs/CACert_Class3Root_x14E228.crt
subject=O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root?

It looks like the CA Root is present and OpenSSL knows about it (existing soon-to-expire server cert):

Code Select Expand

# hostname
charon.lan.null-route.us
# openssl s_client -connect charon.lan.null-route.us:443 | grep -i -e verify
Connecting to 2001:579:4c:2700:6662:66ff:fe25:7341
depth=2 O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority, emailAddress=support@cacert.org
verify return:1
depth=1 O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
verify return:1
depth=0 CN=charon.lan.null-route.us
verify return:1
Verify return code: 0 (ok)
Cross-checking to make sure that the current certs from CACert are loaded:

Code Select Expand

# certctl -v rehash
[snipped for readability]
found /usr/local/share/certs/CACert_Class3Root_x14E228.crt
590d426f: CAcert Class 3 Root
found /usr/local/share/certs/ca-root-opnsense-1.crt
590d426f: duplicate
found /usr/local/share/certs/rootX0F.crt
99d0fa06: CA Cert Signing Authority
found /usr/local/share/certs/ca-root-opnsense-0.crt
99d0fa06: duplicate

and

Code Select Expand

# certctl -v list
localbase:      /usr/local
destdir:
distbase:
unprivileged:   false
verbose:        true
[snipped]
found /etc/ssl/certs/590d426f.0
590d426f: CAcert Class 3 Root
found /etc/ssl/certs/99d0fa06.0
99d0fa06: CA Cert Signing Authority
[snipped]
590d426f.0      CAcert Class 3 Root
99d0fa06.0      CA Cert Signing Authority

[newsense]

Yeah then I'm not sure what's going on, sorry.

You couldn't possibly have the CA pk unless you were that CA...so I'm not sure what's triggering that error message about the CA key

[dseven]

Needing a CA key suggests that you're trying to create a new cert issued by a CA internal to OPNsense. Maybe a silly question, but you are trying to "Import an existing Certificate", not "Create an internal Certificate", right?

[Ed V.]

Correct.

I've tried both "Import an existing Certificate" as well as editing the in-place (active) certificate to update the certificate data (aka "Reissue and replace").