๐ก OPNsense Internal CA & WebGUI SSL/TLS โ Executive Summary
Technical architectural analysis, practical configuration manifests, and deployment instructions for OPNsense Internal CA & WebGUI SSL/TLS.
Step 3 Certificate Chain Issuance
Step 1: Self-signed CA
References and Guidelines (NOTE)
System > Trust > Permissions
- When creating for the first time, you cannot select an issuer. (Always
Nothing selectedorself-signed)
Step 2: Issue intermediate CA
References and Guidelines (NOTE)
System > Trust > Permissions
- How to:
Create an Internal Certification Authority - Issuer: Root CA created earlier
- Same as Root CA except for validity period, description, and common name
Step 3: Issue Leaf Certificate
References and Guidelines (NOTE)
System > Trust > Certificate
Apply Server Certificate
Keychain structure
certificate-bundle.pem
txt
-----BEGIN CERTIFICATE-----
Root CA public key data
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Intermediate CA public key data
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Leaf Certificate public key data
-----END CERTIFICATE-----certificate-bundle.key
txt
-----BEGIN PRIVATE KEY-----
Leaf Certificate private key data
-----END PRIVATE KEY-----Apply OPNSense Dashboard
TLS Termination
Trust CA certificate on client
Download Root CA
Mac
bash
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain $my.pem
Leave a Reply