1

I am using the following web-ui to generate certificates in pfSense:

enter image description here

I was thinking to generate a certificate, suitable for serving from multiple domains, prelimilarly from localhost and nebula3.

Was this correct idea?

Unfortunately, when I am inspecting generated certificate with openssl I see the following

# openssl x509 -noout -subject -in nebula3.crt
subject= /C=RU/ST=Moscow/L=Moscow/O=In The Moon Network/emailAddress=dims12@mail.ru/CN=nebula3

i.e. I see only one CN field and no SAN fields.

Does this definitely mean pfSense has a bug in web-interface or I should watch somewhere else?

  • I am using the last version of pfSense and I too think it is not suitable to generate certificates as I need them. I would advise generating the CSR and the certificate offline, and feeding it to pfSense. Do you need help with that? – Rui F Ribeiro Nov 20 '16 at 10:15
  • @RuiFRibeiro would be appreciated! I wrote a qstn here: unix.stackexchange.com/questions/324678/… – Dims Nov 20 '16 at 10:49
  • 1
    Per your other Q, SAN is not part of Subject and is not displayed by -subject. Use -text and look under X509v3 Extensions. – dave_thompson_085 Nov 20 '16 at 11:59
  • What's the status of this now. I'm trying to do the same thing – Madivad Aug 30 '17 at 2:25
0

As for certificates generated by pfSense, I have been dealing with them recently, and gave up using them on the context of a VPN server.

Basically when signing VPN certificates, I use this extra atributes:

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment

subjectAltName = DNS:youralternanetname.uk, IP:193.x.x.x, DNS:193.x.x.x
nsCertType                      = server
extendedKeyUsage = serverAuth, 1.3.6.1.5.5.8.2.2
keyUsage = digitalSignature, keyEncipherment, dataEncipherment

It seems Windows clients need to see the IP address of your VPN server in the certificate.

You also need to add to the openssl command line CSR request the option: -extensions v3_req or otherwise it won't show up in -nooutbecause it probably is not there.

As for loading my certificates in pfSense, I do:

System->Cert. Manager->Certificates->+Add->Important an existing Certificate. Beware the actual certificate there should contain the entire X.509 certificate chain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.