Certificate verification failed about opn-repo

[Smitimus]

I tried the above options, nothing seemed to work. I found this and compared what I had in the R3 Cert. It was close, but off in a few places. I replaced my R3 cert with the above, and it now works. Hope this helps.

https://forum.opnsense.org/index.php?topic=24950.msg119873#msg119873

[mimugmail]

Go on my website and search the folder where you fetched the conf, then remove the file and run pkg update

I will check the cert prob over the weekend

[burntoc]

Fair enough. So just so I understand the processs and don't muck things up can you verify the following?
Step 1 - Go to /usr/local/etc/package/repos and delete mimugmail.conf
Step 2 - Do my OPN updates and wireguard-kmod reinstall
Step 3 - Run the fetch from your website again to re-pull the conf.
Step 4 - Reboot.

Sound right and my Adguardhome will retain the current config without requiring additional rework?

[mimugmail]

Can you replace recheck .. I dont get any errors

[AdMeik]

Hi Michael,

I have the same issue, remove the conf, remove the expired CA from System/Trust/Authorities, update OPNsense, re-add the Repository (with --no-verify-peer), but Repository Update still comes with:
Updating mimugmail repository catalogue... Certificate verification failed for /O=Digital Signature Trust Co./CN=DST Root CA X3 229124571136:error:1416F086:SSL routines:tls_process_server_certificate:certificate verify

The https://opn-repo.routerperformance.net looks okay, but OPNsense use old/cached? DST RootCA X3.
How to remove, or recheck, what you mean.

THX

[mimugmail]

System : Trust : Authorities and remove the old one?

[burntoc]

If the repo's cert is valid, no removal should be necessary, right?

…

On Sat, Oct 2, 2021, 08:23 Michael ***@***.***> wrote: System : Trust : Authorities and remove the old one? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#73 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACZWF2NPPRZO3YG4N6KCMM3UE4PVPANCNFSM5FFA2ODQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[AdMeik]

Only this is configured.
Repo looks fine: https://www.sslshopper.com/ssl-checker.html#hostname=opn-repo.routerperformance.net think it's a OPNsense thing.
@burntoc I remove the Repository, to update to Latest OPNsense (21.7.3_3), hope that the update fix it.

[burntoc]

Thanks for the update. I still don't understand why this would be necessary if this repo generated a new, unexpired cert?

…

On Sat, Oct 2, 2021, 19:56 Smitimus ***@***.***> wrote: I tried the above options, nothing seemed to work. I found this and compared what I had in the R3 Cert. It was close, but off in a few places. I replaced my R3 cert with the above, and it now works. Hope this helps. https://forum.opnsense.org/index.php?topic=24950.msg119873#msg119873 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#73 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACZWF2LSCOFSYFZGEXLVJ43UE7A7BANCNFSM5FFA2ODQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[Smitimus]

I am not a security professional... But the way I understand things the CA works as the first level of cert verification and is housed on the client side (which would be you opnsense box). In my case a new CA was present, but just had an inaccurate cert.

That said, I did not add the new CA to my box, and the date on it coresponds with an update I did. So, I am inclined to believe opnsense did this during an update. If so, opnsense sent the wrong CA cert to everyone. I may be way wrong on this, and it may just be me that had this particular issue, I am just trying to piece together what I see.

[burntoc]

So it's basically a key with 2 parts. They send the public part to you, and if it matches their private part then it will authenticate. When the cert expired and it gots renewed, it should indicate a newer key and push the public part so you can auth with the new private part. This should all happen without you having to manually remove it, which is why we were able to resolve with the OPNsense official repo without having to remove anything, just an update.

…

On Sat, Oct 2, 2021, 22:20 Smitimus ***@***.***> wrote: I am not a security professional... But the way I understand things the CA works as the first level of cert verification and is housed on the client side (which would be you opnsense box). In my case a new CA was present, but just had an inaccurate cert. That said, I did not add the new CA to my box, and the date on it coresponds with an update I did. So, I am inclined to believe opnsense did this during an update. If so, opnsense sent the wrong CA cert to everyone. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#73 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACZWF2JB2QPEDXP4GXKWUMTUE7R2XANCNFSM5FFA2ODQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[Smitimus]

Again, not a security pro.... But certs are 3 parts. Ca, public, and private. Yes everything SHOULD work automatically. But in my case the CA cert was off. The CA is stored in opnsense and not usually updated, likely for security/spoofing reasons. I'm just sharing my experience and hoping it helps the community. Maybe not, who knows. 🤣

[burntoc]

That's weird that the CA required a manual updates. Even rarer, which is why I didn't mention it, but yeah, that would do it.

…

On Sun, Oct 3, 2021, 09:05 Smitimus ***@***.***> wrote: Again, not a security pro.... But certs are 3 parts. Ca, public, and private. Yes everything SHOULD work automatically. But in my case the CA cert was off. The CA is stored in opnsense and not usually updated, likely for security/spoofing reasons. I'm just sharing my experience and hoping it helps the community. Maybe not, who knows. 🤣 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#73 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACZWF2M3MXXQNB4XTWPXMEDUFB5ODANCNFSM5FFA2ODQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[burntoc]

I got a reply that this repository has been moved to ZeroSSL to address the client-side CA and OPNsense config issues arising from this. Thought I'd confirm that this has fixed the issue here, with no additional adjustments needed on my part. As the CAs and certs are all valid now, the OPNsense update function completes properly again.