opnsense / opnsense/plugins

security/acme-client: automation "restart webGUI" not working

Open
#5,378 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

support
Dominant language
PHP
Stars
1.2k
Forks
863
Avg merge
2d 6h
Merged PRs (30d)
10

Description

Describe the bug
The ACME automation "Restart OPNsense Web UI" is not working anymore:

2026-04-07T12:40:49
opnsense
AcmeClient: ignoring invalid automation: a3552d27-d8e0-4626-a37e-74af673a5ad7

2026-04-07T12:40:49
opnsense
AcmeClient: automation not supported: restart_gui (a3552d27-d8e0-4626-a37e-74af673a5ad7)

This prevents access to the web UI.

  • I can confirm that the certificate was validly renewed by ACME and installed in the file system.
  • I can confirm that the new certificate is shown as "in use" under System/Trust/Certificates.
    However, the new certificate is not being used by the web service (it still uses the old, expired one) and hence access is broken after expiry of the old certificate.
  • Manually running sudo /usr/local/etc/rc.restart_webgui causes the webGUI to use the new certificate, and secure login works again.

To Reproduce
see above.

Expected behavior
The web service to use the new certificate after this has been installed by ACME, whether automagically or by running the ACME automation "webGUI restart".

Screenshots
N/A

Relevant log files
See snippet above.

Additional context
N/A

Environment
OPNsense 26.1.5 (amd64).
Intel® 9500T
Network Intel® i350-T4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the ACME automation identifier restart_gui and the /usr/local/etc/rc.restart_webgui entry point, using the log messages to trace why the automation is rejected. Reproduce certificate renewal and verify that the web service serves the newly installed certificate without manual intervention.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.