Some SSL certificate help please?

[Ed V.]

I'm feeling a bit lost here.

I know that CACert is a niche CA provider, but I've been using them for a couple of decades without any issues, once I import their Class 1 and Class 3 Roots.

For some reason, the 26.7 series of OpnSense has so far been unable to use my CACert certificates in any way.

I've tried newly issued certs, renewed certs, old certs, and nothing works.

I also have tried certs from SSL.com, DigiCert and LetsEncrypt.

Also, no dice.

Even after importing the appropriate CA Root certificates from SSL.com and friends in "System -> Trust -> Authorities", on adding a host certificate in "System -> Trust -> Certificates", I get the same error:

"missing CA key"

What can I check on or provide to assist in further debugging?

Is there a config file somewhere that should have a pointer to a bundled PEM file or files and it's corrupt or missing?

Did I maybe miss something in the upgrade to 26.7 that was needed to update the SSL configuration /settings?

Just looking for some help in getting WebUI SSL up and running again.

[fornax]

Are you just trying to replace the web UI certificate with one signed by a publicly available CA? How exactly are you trying to do it? I've been meaning to do this myself (but with my own CA), so I just did it and it seems to have worked fine. Here's what I did:

• Added root CA certificate (not key) in System -> Trust -> Authorities. (I didn't have any intermediates, but I think if you do you need to add them as well.)
• Created an entry in System -> Trust -> Certificates with method "Create a Certificate Signing Request".
• Downloaded the CSR.
• Uploaded the CSR to the CA to create the certificate.
• Edit the entry in System -> Trust -> Certificates to add the certificate signed by the CA (just paste the cert block into the field on the form).
• Set the new certificate in System -> Settings -> Administration and save.

[Ed V.]

@fornax

That's exactly what I'm trying to do.

Replace the existing (now expired) SSL certificate with a new /renewed certificate from a Publicly Available CA.

The CA's I've attempted are:

CACert (my usual CA)
SSL.com (a fairly well-known CA)
DigiCert (the "granddaddy" CA, only surpassed by Verisign)
LetsEncrypt (ACME based CA)

In each case, I imported /uploaded the Root CA and Intermediate CA bundles before generating the CSR and uploading the signed certificate.

In all attempts, I get the:

"missing CA key"

error message.

[fornax]

At what point are you getting that message? Can you describe the exact steps you're following to generate the CSR and upload the certificate?

Edit: It sounds like you're choosing an option that tells OPNSense to sign a certificate itself (like "Sign a Certificate Signing Request"), which would explain why it thinks it needs a CA key. Instead, you need to edit the line that was created when you generated the CSR. There's a field there for Certificate data where you can paste the cert.