I have a proxmox cluster with pfsense acting as a firewall and gateway for the cluster nodes and VMs. VMs have no problem, but the cluster nodes can't browse any websites using SSL, which of course breaks package updates and things like that.
When I connect directly to the outbound gateway that pfsense uses then all works fine.
I'm not sure where to start with troubleshooting this issue.
for example running apt update:
Failed to fetch http://ftp.uk.debian.org/debian/dists/bullseye/InRelease Certificate verification failed: The certificate is NOT trusted.
curl -v https://ftp.uk.debian.org/debian/dists/bullseye/InRelease
* Trying 78.129.164.123:443...
* Connected to ftp.uk.debian.org (78.129.164.123) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
openssl s_client -connect ftp.uk.debian.org:443
, with and without traffic going through pfSense and compare the Issuer of the certificates presented to you. My Proxmox machine got the following issuers: Let's Encrypt, Internet Security Research Group, Digital Signature Trust Co. If the result you get differ between the with and without pfSense, then you have some TLS inspection going on and the pfSense's root cert will need to be added to your Proxmox servers' trust-anchor store.ca-certificates
package installed, but to know for sure you need to figure out which CA the error is referring to when it saysunknown CA
.