FreeBSD 12 – TLS certificate chain errors break fetch, pkg, and curl – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

HTTPS-dependent tooling fails, blocking updates, API calls, and artifact downloads.

Environment & Reproduction

Occurs after CA bundle corruption, proxy interception, or expired trust roots.

fetch https://pkg.FreeBSD.org
curl -Iv https://freebsd.org
pkg update

Root Cause Analysis

Local trust store lacks required intermediates or presents outdated root certificates.

Quick Triage

Check system date/time and current CA package versions.

date -u
pkg info | grep -i ca_root_nss
openssl version -a

Step-by-Step Diagnosis

Inspect certificate chain presented by remote endpoints and compare against local trust anchors.

openssl s_client -connect pkg.FreeBSD.org:443 -servername pkg.FreeBSD.org /dev/null || true

Solution – Primary Fix

Reinstall CA bundle, rebuild trust store, and retry TLS workflows.

pkg install -fy ca_root_nss
certctl rehash /usr/local/share/certs
pkg update
fetch -qo /dev/null https://www.freebsd.org

Solution – Alternative Approaches

Add enterprise intermediate CA to local trust in controlled environments.

cp corp-intermediate.pem /usr/local/share/certs/
certctl rehash /usr/local/share/certs

Verification & Acceptance Criteria

fetch, curl, and pkg complete HTTPS operations without certificate errors.

curl -I https://www.freebsd.org
pkg update
fetch -qo /dev/null https://download.freebsd.org

Rollback Plan

Remove custom trust anchors if they conflict with baseline security policy.

rm -f /usr/local/share/certs/corp-intermediate.pem
certctl rehash /usr/local/share/certs

Prevention & Hardening

Track CA rotations and automate periodic trust store health checks.

pkg audit -F
pkg upgrade -y ca_root_nss

Related Errors & Cross-Refs

Can coincide with time drift, DNS poisoning, and outbound proxy TLS interception.

Related tutorial: View the step-by-step tutorial for FreeBSD 12.

View all FreeBSD 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

FreeBSD TLS trust store, certctl, and pkg HTTPS repository documentation.