Fresh 26.10 installation report

[mooh]

Today, I did a fresh install on a DEC750. The machine had a bit of a checkered past. So, I wanted to take the opportunity to start from scratch, install the latest BIOS and do away with the legacy stuff, moving to dnsmasq and the new rules at the same time. Everything had been prepared on a test machine running 26.7.x and that backup was used to restore the configuration of the DEC750.

In summary, everything went well.

Some things didn't work as expected though:

• I chose the OPNsense-business-26.10-vga-amd64 installation image. I never got a login prompt on the console during installation. I probably should have chosen the serial version. Login via ssh didn't work either because
• The LAN interface does not issue dhcp addresses by default. I had to configure the ethernet interface of my PC manually.
• The installation and restoring the config went just fine. However, a check for updates after the reboot resulted in the re-installation of the OPNBEcore package. Not sure if this is the intended behaviour after entering the subscription key. In any case, there were a number of messages about missing CRLs.

Here's the log output:

Code Select Expand

***GOT REQUEST TO UPDATE***
Currently running OPNsense 26.10 (amd64) at Fri Oct 30 15:27:31 CET 2026
Strict TLS 1.3 and CRL checking is enabled.
Updating OPNsense repository catalogue...
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (166 candidates): .......... done
Processing candidates (166 candidates): . done
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
opnsense-business-26.10 [OPNsense] (Vital flag changed: 'true' -> 'false')

Number of packages to be reinstalled: 1

6 MiB to be downloaded.
No CRL was provided for CA /C=AT/O=ZeroSSL GmbH/CN=ZeroSSL RSA DV SSL CA 2
No CRL was provided for CA /C=GB/O=Sectigo Limited/CN=Sectigo Public Server Authentication Root R46
[1/1] Fetching opnsense-business-26.10: .......... done
Checking integrity... done (0 conflicting)
[1/1] Reinstalling opnsense-business-26.10...
[1/1] Extracting opnsense-business-26.10: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh.sh'
Flushing all caches...done.
Writing firmware settings: OPNsense
Writing trust files...done.
Scanning /usr/share/certs/untrusted for certificates...
Scanning /usr/share/certs/trusted for certificates...
Scanning /usr/local/share/certs for certificates...
certctl: No changes to trust store were made.
Writing trust bundles...done.
Configuring login behaviour...done.
Configuring cron...done.
Configuring system logging...done.
=====
Message from opnsense-business-26.10:

--
Just a dream and the wind to carry me
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
/var/cache/pkg/opnsense-business-26.10.pkg
/var/cache/pkg/opnsense-business-26.10~2$gokh8ff6.pkg
The cleanup will free 6 MiB
Deleting files: .. done
Nothing to do.
Flushing temporary package files... done
Starting web GUI...done.
***DONE***


[mooh]

The CRL issue can be resolved by choosing "Deciso (HTTPS,NL,Commercial)" as the mirror instead of "Deciso (HTTPS,Commercial)"