Skip to content
Docs sslbrain sslbrain.com

OPNsense

Copy link to the page “OPNsense”

← All integrations

Firewall and VPN

Renews the Web GUI certificate automatically and retains the previous certificate for rollback.

The appliance runs the package and connects to OPNsense through Trust API + SSH over HTTPS on port 443. No agent is installed on OPNsense.

What happens

  1. The appliance connects to OPNsense through Trust API + SSH on port 443.
  2. Finds the version, selected Web GUI certificate and certificate managers for Web GUI.
  3. Imports the new leaf, key and certificate chain. Existing certificates and other services are retained; only Web GUI automations are detached.
  4. Selects the new certificate, restarts only Web GUI and checks the served leaf and complete intermediate chain. If it fails: On failure, SSH restores the previous binding and Web GUI automations, including when HTTPS disconnects. The old certificate is checked after restart.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to Trust API + SSH, port 443. No agent is installed.
Service ports
443, 22
You need
API key with System Trust access and root SSH access to native configuration and Web GUI restart. Management TLS and the SSH host key are verified by default.
Platform
OPNsense 24.1 and later; discovery selects Trust API or native import by version
Actions
Discovery, Installation, Verification, Rollback
Packages
opnsense-api 1.0.0
Note
  • Appliance 0.4.44 or later. Save a SHA-256 pin or trusted CA for a self-signed management certificate before the first connection. The certificate must cover the management name or IP and include the required issuer chain. Each HA management address is a separate destination.

Get started