SSL in the jails problem after upgrading to Truenas 12

[petoniano]

Hi, I have a Truenas machine mostly for personal/family storage, and also for plex server.

I have a jail with the plex plugin and another one for instaling pkgs for different services I want to try and use.

I updated mi working system from 11.1 to Truenas 12. And my jails stopped working. So I decided to create the Jails from the beggining. (I´ve found the files in case I need a config file for example)
The plex plugin worked without issues. But the other one is giving me some errors.

I added new jail: named: freenas_pkgs Jail Type: Default Clone Jail Release: 12.1 release, gave an static ip and the jail was created ok.

then enabled ssh to acccess the jail. And started to install packages that I used to have. And there is when I had errors related to SSL certificates I think

for example: I installed with pkg install py37-speedtest-cli and was installed without errors and then when I try speedtest gave me this error:

Code:

Carlos@freebsd-pkg:~ % speedtest
Retrieving speedtest.net configuration...
Cannot retrieve speedtest configuration
ERROR: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)>
Carlos@freebsd-pkg:~ %

other exampl is whe installed wget and when I try to get a https://file gave me errors too (for example a test file) like:

Code:

Carlos@freebsd-pkg:~ % wget https://speed.hetzner.de/1GB.bin
--2020-10-26 21:22:52--  https://speed.hetzner.de/1GB.bin
Resolving speed.hetzner.de (speed.hetzner.de)... 88.198.248.254, 2a01:4f8:0:59ed::2
Connecting to speed.hetzner.de (speed.hetzner.de)|88.198.248.254|:443... connected.
ERROR: cannot verify speed.hetzner.de's certificate, issued by 'CN=Thawte TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US':
  Unable to locally verify the issuer's authority.
To connect to speed.hetzner.de insecurely, use `--no-check-certificate'.
Carlos@freebsd-pkg:~ %

when I try to download an http://file there is no problem and download it fine.

So I don´t have much knowledge about SSL certificates, in my anterior 11.1 jail I didn´t have that problem and never played with certificates. I´ve read the documentation, and googled a lot and I´m very lost.
Do I have to install an SSL certificate inside my jail to access https files or services? I´ve read that letsencrypt can create free certificates but I don´t know where to continue.

Anyone can show me a litle of light and could tell me if that is my problem? and where to continue to solve this?

Thank you very much, I spent lots of hours researching since the update but i am lost.

 

[Jailer]

pkg install ca_root_nss should solve your problem.

 

[colmconn]

did you install the ca_root_nss package?

 

[petoniano]

omg!, thank you both, that worked for me.
What does that package do? just to try to understand the problem

thank you again

 

[sretalla]

What does that package do?

ca_root_nss gives your system pointers to all of the well known root certificate authorities, so I suppose your root certificate provider:
OU=www.digicert.com,O=DigiCert Inc,C=US

Is in that list, making it possible for your system to:
verify speed.hetzner.de's certificate, issued by 'CN=Thawte TLS RSA CA G1,OU=www.digicert.com,O=DigiCert Inc,C=US':