Post-Handshake New Session Ticket arrived: Verify return code: 20 (unable to get local issuer certificate) Verification error: unable to get local issuer certificate SSL handshake has read 3530 bytes and written 398 bytes Issuer=C = US, O = Let's Encrypt, CN = R3 I:O = Digital Signature Trust Co., CN = DST Root CA X3 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX. Verify error:num=20:unable to get local issuer certificate Yes, there is an alternative chain available:īut it provides worse compatibility with older clients and should not provide any benefits.ĭoes this make sense to you? Is there something wrong with this explanation?ĭepth=1 C = US, O = Let's Encrypt, CN = R3 However, I can confirm that Chrome still shows the the same output that you've posted in the screenshot. Subject: C = US, O = Internet Security Research Group, CN = ISRG Root X1Īnd viewing the resulting cert chain in Firefox 92 it seems that it already prefers the X1 route over the expiring X3. Issuer: O = Digital Signature Trust Co., CN = DST Root CA X3 Subject: C = US, O = Let's Encrypt, CN = R3 Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X1 Signature Algorithm: sha256WithRSAEncryption Otherwise they all need to be configured on the default WireGuard group that OPNsense creates.# openssl x509 -noout -text -in /tmp/chain1.crtĩ1:2b:08:4a:cf:0c:18:a7:53:f6:d6:2e:25:a7:5f:5a Second, it automatically adds an IPv4 outbound NAT rule, which will allow the tunnel to access IPv4 IPs outside of the local network (if that is desired), without needing to manually add a ruleįinally, it allows separation of the firewall rules of each WireGuard instance (each wgX device). Otherwise you will need to define your own alias or at least manually specify the subnet(s) However, it is useful to implement, for several reasons:įirst, it generates an alias for the tunnel subnet(s) that can be used in firewall rules. This step is not strictly necessary in any circumstances for a road warrior setup.

Opnsense adguard