Plugins: security/acme-client: CA chain still contains X3 CA when the cert was signed by the R3 CA

[fraenki]

Let's Encrypt changed its issuer to R3 yesterday. Certificates can still be renewed. But afterwards the CA chain will still contain the X3 instead of the R3 CA.

Our Let's Encrypt plugin imports all Let's Encrypt certificates and CA certificates into the OPNsense trust storage. When doing this the certificate is referenced to the CA by using the caref attribute. However, this attribute is never updated. As a result applications like HAProxy will send an invalid certificate chain, effectively breaking SSL communication.

I'm working on a fix and will provide a workaround shortly.

[fraenki]

Workaround / Hotfix

NOTE: Only applicable to OPNsense 20.7.5.

First apply the fix:

opnsense-patch -c plugins f44af645

However, this will not fix existing certs. You have to visit Services: Let's Encrypt: Certificates and forcefully re-issue all affected certificates. This should cause an re-import of the certificate and the CA chain should be fixed.

Don't forget to restart all services that use this certificate afterwards.

[fraenki]

OPNsense 20.7.6 includes the fix:
https://forum.opnsense.org/index.php?topic=20389.0

As stated in the release announcement, you have to forcefully re-issue any certificate (that is affected by this bug) to fix the invalid CA chain.