pfSense

Jim Pingle wrote:

It does exclude certificates when all areas that need certificate sync are disabled. OpenVPN requires certs to sync, so if you have OpenVPN sync enabled, then it will also sync certs. To disable cert sync entirely, you must also disable OpenVPN sync.

I am pushing a commit to add a note to OpenVPN stating it implies cert sync to make this relationship more obvious.

The correct procedure for what you describe is to import all certs to the primary, and then select on secondary after they sync. You can also do one cert with SANs for both (which is best for LE).

I'm not using certs in OpenVPN so didn't check that behavior.

Jim Pingle wrote:

The correct procedure for what you describe is to import all certs to the primary, and then select on secondary after they sync. You can also do one cert with SANs for both (which is best for LE).

Yep, I ended up using one cert with SANs for both hosts/IPs.

Even openvpn needs synced certs I would like not to sync them because of ACME certs.

Or skip deleting used ACME certs on backup systems.

My domain:
pfsense1.domain.tld 5.5.5.1 (static)
pfsense2.domain.tld 5.5.5.2 (static)
pfsense-ha.domain.tld 5.5.5.3 (CARP)

Pfsense1 can't create a certificate for pfsense2 because DNS points to pfsense2 and ACME needs a valid DNS entry.
And no I can't change to DNS challenge.

Then you are using ACME incorrectly. Read the previous comments or post on the forum if you have further questions. You can't have it both ways.

2.4.4-p3 looks good:

NAT configuration
IPsec configuration
OpenVPN configuration (Implies CA/Cert/CRL Sync)
DHCP Server settings
WoL Server settings