pfSense

Hi Jim,

Thanks for taking a look at my issue.

I did a fresh demo install on VirtualBox with 2.4.1. Performed the GUI wizard post-install with DHCP for WAN and then went straight to the certificate manager. Created my CA and then my server certificate with an IP address SAN. Works like a charm.

When I did a fresh install of 2.4.1 on my production system I get the same issue with the blank certificates. Packages installed prior to making my own CA and server certificates include ACME (account setup with one LE server cert), pfBlockerNG, and Squid.

How would I go about sending info in privately?

Thanks in advance!

So you used the exact same input on both systems and it worked on one and failed on the other?

Please take screenshots of each step you make when creating the problem certificates, and forward those along with the other info to me. jimp [at] pfsense {dot} org.

I can't seem to replicate that here. I used the exact same inputs you sent via e-mail and it worked as expected on 2.4.1 and 2.4.2 snapshots. I get a usable CA and server certificate, no errors, and nothing is blank/empty.

The certificate error "PEM_read_bio:no_start_line" usually means that the certificate data passed to OpenSSL either wasn't valid or somehow could not be read. Though it's not quite clear exactly which item it's talking about. It could be the CA certificate or the temporary CSR for the server certificate.

Can you replicate this on any other system you have? First and foremost, make sure it's on 2.4.1 (or a 2.4.2 snapshot) before trying it again. It's possible there is something else wrong/out of date on that box unrelated to the certificate code.

I'm having the same issue on a freshly upgraded factory configured SG-8860. This happens with my existing CA as well as with any new ones I create.
I can confirm that /usr does not have it's own mount point.

Is there a telltale way to see if the product name was read properly? I do see all of the fields populated with information on the dashboard.

I can open a new issue if you'd like.

It will appear OK after booting, most tests will look fine then. You have to watch the console during boot time, the errors show there and are not logged.

If you update to a 2.4.2 snapshot it should be OK now.

Hi, sorry to necro but this bug still seems to exist in 2.4.2p1.

User Certifactes meant for OpenVPN I just issued are all empty.

It doesn't seem to make a difference wether I issue the certifacte while creating a user or issue the certificate in the certifcate manager manually.

I tried issuing the certifactes using my existing CA and with a freshly created CA but the outcome remains the same.

Highly unlikely that it's the same issue. Post on the forum, pfSense subreddit, or mailing list to discuss and diagnose your specific problem.

We are also seeing this issue in production. I posted to the subreddit, but everything seems to be exactly the same as what's described above.