installing ISP crt file

[sirsnir]

hi.
i have a running truenas 13 system.
locally on my lan,everything is perfect.
in order to download plugins,my isp requires a crt installation on every device(it's a special ISP that gives internet filteration services),and i can't figure how to install the crt file on the system.without it i can't access any https website...can someone help with that?

 

[joeschmuck]

You should be more specific in exactly what you are doing and what you need https access for on a TrieNAS system. Are you running a file sharing service, download service, trying to update TrueNAS, cloud backup, etc... The cert may need to be installed in the jail/vm application. I'm not the expert on this topic but in order for someone to provide you good feedback, you need to provide more details, including what version of TrueNAS 13 you are running. You might even need to provide more details on your ISP.

 

[sirsnir]

let's be more focused...when trying to create new jail i get:
HTTPSConnectionPool(host='www.freebsd.org', port=443): Max retries exceeded with url: /security/unsupported.html (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer
this kind of error usually happens with my isp when the crt is not installed
updates do work,if i remember i did install something somehow don't remember how,it was long time ago...
but,if i can't create new jails,i can't install plugins that requires jails...

 

[joeschmuck]

what version of TrueNAS 13 you are running

 

[sirsnir]

TrueNAS-13.0-U3

 

[danb35]

From your description, it sounds like your ISP inspects all the traffic in and out of your network, which includes decrypting and re-encrypting all encrypted traffic. In order to do that, it creates its own certificates for sites you visit, signing them with its own (fake) security certificate. This is a horribly insecure arrangement, and you shouldn't tolerate it.

You're asking how to get TrueNAS to trust a cert it shouldn't trust. I'm not aware of any way to make it do that.

 

[sirsnir]

i'm aware of the process,that's the reason i chosed this ISP....