security/acme-client: automation "restart webGUI" not working
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 1.2k
- Forks
- 863
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 10
Description
- I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
- I have searched the existing issues, open and closed, and I'm convinced that mine is new.
- The title contains the plugin to which this issue belongs
Describe the bug
The ACME automation "Restart OPNsense Web UI" is not working anymore:
2026-04-07T12:40:49
opnsense
AcmeClient: ignoring invalid automation: a3552d27-d8e0-4626-a37e-74af673a5ad7
2026-04-07T12:40:49
opnsense
AcmeClient: automation not supported: restart_gui (a3552d27-d8e0-4626-a37e-74af673a5ad7)
This prevents access to the web UI.
- I can confirm that the certificate was validly renewed by ACME and installed in the file system.
- I can confirm that the new certificate is shown as "in use" under System/Trust/Certificates.
However, the new certificate is not being used by the web service (it still uses the old, expired one) and hence access is broken after expiry of the old certificate. - Manually running
sudo /usr/local/etc/rc.restart_webguicauses the webGUI to use the new certificate, and secure login works again.
To Reproduce
see above.
Expected behavior
The web service to use the new certificate after this has been installed by ACME, whether automagically or by running the ACME automation "webGUI restart".
Screenshots
N/A
Relevant log files
See snippet above.
Additional context
N/A
Environment
OPNsense 26.1.5 (amd64).
Intel® 9500T
Network Intel® i350-T4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the ACME automation identifier restart_gui and the /usr/local/etc/rc.restart_webgui entry point, using the log messages to trace why the automation is rejected. Reproduce certificate renewal and verify that the web service serves the newly installed certificate without manual intervention.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100