Some SSL certificate help please?

[Ed V.]

I'm feeling a bit lost here.

I know that CACert is a niche CA provider, but I've been using them for a couple of decades without any issues, once I import their Class 1 and Class 3 Roots.

For some reason, the 26.7 series of OpnSense has so far been unable to use my CACert certificates in any way.

I've tried newly issued certs, renewed certs, old certs, and nothing works.

I also have tried certs from SSL.com, DigiCert and LetsEncrypt.

Also, no dice.

Even after importing the appropriate CA Root certificates from SSL.com and friends in "System -> Trust -> Authorities", on adding a host certificate in "System -> Trust -> Certificates", I get the same error:

"missing CA key"

What can I check on or provide to assist in further debugging?

Is there a config file somewhere that should have a pointer to a bundled PEM file or files and it's corrupt or missing?

Did I maybe miss something in the upgrade to 26.7 that was needed to update the SSL configuration /settings?

Just looking for some help in getting WebUI SSL up and running again.

[fornax]

Are you just trying to replace the web UI certificate with one signed by a publicly available CA? How exactly are you trying to do it? I've been meaning to do this myself (but with my own CA), so I just did it and it seems to have worked fine. Here's what I did:

• Added root CA certificate (not key) in System -> Trust -> Authorities. (I didn't have any intermediates, but I think if you do you need to add them as well.)
• Created an entry in System -> Trust -> Certificates with method "Create a Certificate Signing Request".
• Downloaded the CSR.
• Uploaded the CSR to the CA to create the certificate.
• Edit the entry in System -> Trust -> Certificates to add the certificate signed by the CA (just paste the cert block into the field on the form).
• Set the new certificate in System -> Settings -> Administration and save.

[Ed V.]

@fornax

That's exactly what I'm trying to do.

Replace the existing (now expired) SSL certificate with a new /renewed certificate from a Publicly Available CA.

The CA's I've attempted are:

CACert (my usual CA)
SSL.com (a fairly well-known CA)
DigiCert (the "granddaddy" CA, only surpassed by Verisign)
LetsEncrypt (ACME based CA)

In each case, I imported /uploaded the Root CA and Intermediate CA bundles before generating the CSR and uploading the signed certificate.

In all attempts, I get the:

"missing CA key"

error message.

[fornax]

At what point are you getting that message? Can you describe the exact steps you're following to generate the CSR and upload the certificate?

Edit: It sounds like you're choosing an option that tells OPNSense to sign a certificate itself (like "Sign a Certificate Signing Request"), which would explain why it thinks it needs a CA key. Instead, you need to edit the line that was created when you generated the CSR. There's a field there for Certificate data where you can paste the cert.

[Ed V.]

I've tried all three "logical" options with all four CA providers, after ensuring that the provider CA cert chains have been imported:

Import an existing Certificate
Import certificate (signed by CA)
Reissue and replace certificate (does not restart services)

All fail with the same "missing CA key" message.

I've tried the various suggestions from a prior topic:
https://forum.opnsense.org/index.php?topic=52641

With zero success.

I'm now up to release 26.7.3_11 and still seeing the same issue.

Something changed about how OpnSense processes SSL certificates in the v25 -> v26 progression (the last time I had to import /update certs was in v25 and it worked flawlessly).

I am very hopeful that someone with deeper insight into how the front-end is processing the cert upload /update can clue me in on what I need to do to get this working again.

WebUI, CLS, whatever...

[Patrick M. Hausen]

Edit the CSR ...

[Ed V.]

Not to be completely clueless - but can you unpack that a bit?

Edit the CSR in what way?

The text of it?

E.g. the part that has "MIIEvzCCAqcCAQAwMDELMAkGA1UEBhMCVVMxITAfB" and so on...

How it's created?

I like to think I have some competence in the tech world, but this is proving that maybe I don't have as much as I thought.

[fornax]

When you perform the step on the Certificates page to generate the CSR, it creates a line on that page. Once you have the cert from the CA, you click the Edit button on that same line. There'll be an empty box in the edit page for you to paste in the cert.

[Patrick M. Hausen]

System > Trust > Certificates

Click on the "+", select "Create Certificate Signing Request", continue with all your data. After you signed the CSR with your CA in the same menu click on the "edit" icon for the CSR - the little pencil. Paste the signed certificate date into the empty box at the top labelled "Certificate data". Save. Done.