FreeBSD 12 – Common Problem 011 – pkg Install Fails Due to SSL Certificate Errors

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Package installation fails, leaving systems unpatched and inconsistent.

Environment & Reproduction

`pkg install` on newly provisioned images or old snapshots returns SSL verification errors.

Root Cause Analysis

CA bundle missing/outdated, incorrect system time, or transparent proxy TLS interception.

Quick Triage

Check time and CA package state.

date -u
pkg info -x ca_root_nss
fetch https://pkg.freebsd.org/

Step-by-Step Diagnosis

Validate cert store and inspect failing chain.

certctl list | head
openssl s_client -connect pkg.freebsd.org:443 -servername pkg.freebsd.org </dev/null
ls -l /etc/ssl/certs

Solution – Primary Fix

Install CA roots, refresh links, and retry install.

pkg bootstrap -f
pkg install -y ca_root_nss
certctl rehash

Solution – Alternative Approaches

Configure enterprise proxy root CA explicitly if outbound TLS is inspected by policy.

Verification & Acceptance Criteria

`pkg install` completes over HTTPS without certificate warnings.

Rollback Plan

Restore prior cert store backup and revert proxy trust changes if trust breaks other workflows.

Prevention & Hardening

Track CA bundle age and include trust-store health checks in base image tests.

Related Errors & Cross-Refs

`SSL certificate problem`, `certificate verify failed`, handshake aborts.

Related tutorial: View the step-by-step tutorial for freebsd-12.

View all freebsd-12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

`certctl(8)`, OpenSSL manpages, pkg secure transport docs.