TrueNAS Core to Scale TLS changes

TrueNAS General
1

So, before I begin, I have been running TrueNAS since it was FreeNAS. Starting sometime around 2017. I have my own CA that issues short-lived certificates:

(Its a great homelab project, I highly recommend it).

I have normally been running two shell scripts from cron that keep the certificates up to date in TrueNAS Core:

Hourly check script as a “failsafe” if the main script does not run on time:

#!/bin/bash

if echo -n | openssl s_client -showcerts -servername freenas.home.lan -connect freenas.home.lan:443 2>/dev/null | openssl x509 -checkend 600
then
  echo "Certificate is good, don't renew." 
else echo "Certificate has  expired or will do soon!" 
echo "(or is invalid/not found)" 
echo  "Forcing renewal." 
/root/freenas_certificate.sh
fi

The main script:

#!/bin/bash

# get cert working
/usr/sbin/service nginx stop
/root/.acme.sh/acme.sh --issue --force --standalone -d freenas.home.lan -d freenas --server https://tinyca.home.lan/acme/acme/directory --ca-bundle /root/certs/ca.crt --key-file /root/.step/certs/freenas.key /usr/sbin/service nginx start
# place cert
/root/git_scripts/deploy-freenas/deploy_freenas.py

This has been working for years. And if I am to be honest, I forget how I set it up (but is based on an old community post where other TrueNAS users are doing the same thing).

My certificate did not renew today, and I cannot make it manually renew:

Screenshot 2025-01-12 at 10.01.30 AM
Screenshot 2025-01-12 at 10.01.30 AM1558×450 123 KB

This is all based around the excellent contribution from danb35:

This old method that I use, has unfortunately destroyed the GUI for TrueNAS Scale post upgrade:

Screenshot 2025-01-12 at 10.10.19 AM
Screenshot 2025-01-12 at 10.10.19 AM1704×1306 95 KB

I still have SSH access.

Any ideas on the best way to repair this?

2

Did you try the troubleshooting steps?
From your logs, apparently SCALE lacks the socst tools.

3

Yes, that is what I am working through, but getting up to speed on the changes from Core to Scale is slowing me down a lot:

root@freenas[~]# apt-get install -y socat
Package management tools are disabled on TrueNAS appliances.

It also seems that my scripts are out of date. I think I installed the TLS code right after it was released, and have not updated it since.

4

Ok, I got it working. Here is what was needed:

Go into the deploy-freenas and freenas-nginx-swap directories, and run a

git pull origin master

Then merge my changes for my conf file, because things were wildly out of date on my end.

Next, enable developer mode per this:

install-dev-tools

(BE SURE YOU UNDERSTAND WHAT THE ABOVE DOES!)

This allowed me to run:

apt-get install -y socat

And with that, acme works again, and I was able to renew my certificate.