Unable to import Trust Authorities after upgrade to v26.7.8

[chandrayandeepak]

After upgrade to v26.7.8, unable to import Private CA in trust authorities, throwing error "Only a single private key is allowed (found 0 sections)". Same works fine in earlier versions.

[franco]

How does the private key start and end with? The "----" parts I mean.


Cheers,
Franco

[chandrayandeepak]

Importing RootCA and Intermediate, not using Private key, just the certificate.

[franco]

Please take note of:

https://github.com/opnsense/changelog/blob/16a1fae3e4c0e4a2faccccf100e8c4045caec966/community/26.7/26.7.8#L18-L22

If it's just public certs please attach them here and describe exactly how you are trying to add them so we can reproduce as well.


Thanks,
Franco

[chandrayandeepak]

They are Private authority certificates, already using in earlier versions of OPNsense CE. We follow:

System -> Trust -> Authorities -> Add -> Import an existing Certificate Authority and paste. Screenshots attached.

BTW, we were able to import leaf certificate successfully.

-----BEGIN CERTIFICATE-----
....
-----END CERTIFICATE-----

[Monviech (Cedrik)]

You have to import the root and the intermediate sepatately now.

one cert per import.

[ab]

I think I've hit the same issue. I'm trying to migrate from using os-acme-client to injecting certs from outside using the API. I can import a new leaf cert, but I cannot add any of the Let's Encrypt intermediate CAs. As a result, the web server serves only the leaf cert without any intermediates, and non-browser clients (e.g. curl) can't validate it.

Repro instructions from the UI:
1. Navigate to System: Trust: Authorities
2. Click Add
3. Choose "Import an existing Certificate Authority"
4. Enter a description, paste the single cert below into the Certificate data field, and leave the private key data blank
5. Click Save

This results in the error: "Only a single private key is allowed (found 0 sections)"

Needless to say, I don't have the key for this cert.

-----BEGIN CERTIFICATE-----
MIIEcDCCAligAwIBAgIQbI8dxyfHEX97r4U6yYD5zTANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNjA1MTMwMDAwMDBa
Fw0zMjA5MDIyMzU5NTlaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5l
dCBTZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgy
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0H
ttwW+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7
AlF9ItgKbppbd9/w+kHsOdx1ymgHDB/qo4H1MIHyMA4GA1UdDwEB/wQEAwIBBjAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd
BgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwHwYDVR0jBBgwFoAUebRZ5nu2
5eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
Oi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcGA1UdHwQg
MB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcNAQELBQAD
ggIBAD2/e9frmMxNpCV03qUHegg+MV2wz9644YoXdqtH8RyWYcBO7xfjjGEXdU1e
/o0OkEFiynUCOSIk/vLLo7ttz6CPAeNlWfC0XNkoGeWgK6jjXvozBaGuGH5n0Ufo
shMeWTuURqNN5G00sSXDTBrpp2+mgvdZQjb8K11TYMA25QA+YHNfbIEL0BniAhKS
2gsnJjSzrdZLI+EZ7SEyqdR2rkjd1KutLDU+n3TFyxjniZVGur4YlhMP3mY/dV95
IruAkkjOZier6hGBdEgZXXvaCz9u9iVEadsIE75pAGL8oHV5vxdARDiotRpul1IN
/UZwzAbrfUFcw1HkAcYD/mlZfnQ2ieCF2MS7j3Vhv7JPDKp45fmykmzYNSrumRW0
upFFKDBOoF7hsOb7oLyHS+Uft6jOUfOrogj8YUx38hKb2K20r42OgsSdDdxdeYWc
MS3Sb6mwJeSZEYxJ2gaXnDSPaKhhrNkYwljyVQyr4Nq+MEJytXNTnHqaAcrNwZlV
pcJL1KBnMrMjP7eanvUwL3FYj3cF17jtboLt7gLoi4+2rWZFvn+w54jmd/FIuhhZ
cEaU/wvU6BUNMtcVquVGHp7itQeDth5j+XL3j4WJ2SABwzUl6OeYdgpIt/ITZa+p
TT0mQ/r5XyA4MEAiabn7XJjvCERlF2dcn2wqJw+CreTkkQ2R
-----END CERTIFICATE-----

[ab]

Likely a regression in https://github.com/opnsense/core/commit/b64be86839271b108e0c140fb53349303ddb6d5c

[chandrayandeepak]

@Monviech (Cedrik) : Yes, we tried single certificate at once, but unable to.

@ab : Your replication is exactly like ours. Without issuing PrivateCA in Trust, leaf aren't trusted.

[ab]

Even after hacking around the private key check, I can find no way to import a full Let's Encrypt cert bundle with its intermediate CAs so that they get picked up by the web server. All the prior CA imports have the multiple certs in one entry, which is what is now explicitly blocked.

I've filed https://github.com/opnsense/core/issues/11130

[chandrayandeepak]

Even not permitting one by one import.
BTW, there is no other certificate visible in Authorities!