{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/", "item": { "id": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/", "slug": "select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry", "url": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry.md", "json": "https://update.dsesecurity.com/api/v1/posts/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/" }, "title": "Select the pfSense certificate purpose before troubleshooting an unavailable entry", "summary": "A certificate can be present in the manager yet unsuitable for a service's required usage.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:12+00:00", "modified_at": "2026-10-20T18:34:34+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 250, "potentially_affected": "This concerns pfSense certificate creation and selection.", "dse_recommendation": "DSE recommends documenting the intended role before generating or importing a certificate.", "primary_source": { "name": "Netgate — Certificate Management", "url": "https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A certificate can be present in the manager yet unsuitable for a service’s required usage.

\n

Source facts

\n

Netgate states that the selected certificate type controls key-usage properties and limits where the certificate can be used. User certificates carry client-authentication usage, while server certificates carry server-authentication usage. Using the wrong purpose can cause an error or prevent the certificate from appearing in a service’s selection list. A CSR is sent to the issuer without its private key.

\n

Source: Netgate — Certificate Management.

\n

Applicability

\n

This concerns pfSense certificate creation and selection.

\n

DSE recommendation

\n

DSE recommends documenting the intended role before generating or importing a certificate. If an entry is missing from a service’s selector, inspect its usage properties before weakening validation or importing duplicate keys. Keep the private key under controlled custody and transmit only the CSR when requesting external signing. Use descriptions that distinguish client and server roles so a later renewal does not perpetuate the wrong purpose. Include the required certificate purpose in the service handoff checklist. Ask the operator to inspect that property before replacing keys or changing trust settings, and preserve the intended client/server use beside the certificate identifier so later renewals retain the design decision.

\n

Verification

\n

Inspect the certificate’s usage extensions and confirm that the intended service can select it. Complete an authorized test handshake from a representative peer with normal validation enabled. Record the role and issuer without copying private-key material into the acceptance evidence or a support ticket.

\n

Official reference

\n

Netgate — Certificate Management. Reviewed October 20, 2026.

", "content_text": "A certificate can be present in the manager yet unsuitable for a service’s required usage.\nSource facts\nNetgate states that the selected certificate type controls key-usage properties and limits where the certificate can be used. User certificates carry client-authentication usage, while server certificates carry server-authentication usage. Using the wrong purpose can cause an error or prevent the certificate from appearing in a service’s selection list. A CSR is sent to the issuer without its private key.\nSource: Netgate — Certificate Management.\nApplicability\nThis concerns pfSense certificate creation and selection.\nDSE recommendation\nDSE recommends documenting the intended role before generating or importing a certificate. If an entry is missing from a service’s selector, inspect its usage properties before weakening validation or importing duplicate keys. Keep the private key under controlled custody and transmit only the CSR when requesting external signing. Use descriptions that distinguish client and server roles so a later renewal does not perpetuate the wrong purpose. Include the required certificate purpose in the service handoff checklist. Ask the operator to inspect that property before replacing keys or changing trust settings, and preserve the intended client/server use beside the certificate identifier so later renewals retain the design decision.\nVerification\nInspect the certificate’s usage extensions and confirm that the intended service can select it. Complete an authorized test handshake from a representative peer with normal validation enabled. Record the role and issuer without copying private-key material into the acceptance evidence or a support ticket.\nOfficial reference\nNetgate — Certificate Management. Reviewed October 20, 2026.", "content_markdown": "A certificate can be present in the manager yet unsuitable for a service’s required usage.\n\n## Source facts\n\nNetgate states that the selected certificate type controls key-usage properties and limits where the certificate can be used. User certificates carry client-authentication usage, while server certificates carry server-authentication usage. Using the wrong purpose can cause an error or prevent the certificate from appearing in a service’s selection list. A CSR is sent to the issuer without its private key.\n\nSource: [Netgate — Certificate Management](https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html).\n\n## Applicability\n\nThis concerns pfSense certificate creation and selection.\n\n## DSE recommendation\n\nDSE recommends documenting the intended role before generating or importing a certificate. If an entry is missing from a service’s selector, inspect its usage properties before weakening validation or importing duplicate keys. Keep the private key under controlled custody and transmit only the CSR when requesting external signing. Use descriptions that distinguish client and server roles so a later renewal does not perpetuate the wrong purpose. Include the required certificate purpose in the service handoff checklist. Ask the operator to inspect that property before replacing keys or changing trust settings, and preserve the intended client/server use beside the certificate identifier so later renewals retain the design decision.\n\n## Verification\n\nInspect the certificate’s usage extensions and confirm that the intended service can select it. Complete an authorized test handshake from a representative peer with normal validation enabled. Record the role and issuer without copying private-key material into the acceptance evidence or a support ticket.\n\n## Official reference\n\n[Netgate — Certificate Management](https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/", "url": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Select the pfSense certificate purpose before troubleshooting an unavailable entry", "item": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/#article", "identifier": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/", "url": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/", "headline": "Select the pfSense certificate purpose before troubleshooting an unavailable entry", "description": "A certificate can be present in the manager yet unsuitable for a service's required usage.", "abstract": "A certificate can be present in the manager yet unsuitable for a service's required usage.", "articleBody": "A certificate can be present in the manager yet unsuitable for a service’s required usage.\nSource facts\nNetgate states that the selected certificate type controls key-usage properties and limits where the certificate can be used. User certificates carry client-authentication usage, while server certificates carry server-authentication usage. Using the wrong purpose can cause an error or prevent the certificate from appearing in a service’s selection list. A CSR is sent to the issuer without its private key.\nSource: Netgate — Certificate Management.\nApplicability\nThis concerns pfSense certificate creation and selection.\nDSE recommendation\nDSE recommends documenting the intended role before generating or importing a certificate. If an entry is missing from a service’s selector, inspect its usage properties before weakening validation or importing duplicate keys. Keep the private key under controlled custody and transmit only the CSR when requesting external signing. Use descriptions that distinguish client and server roles so a later renewal does not perpetuate the wrong purpose. Include the required certificate purpose in the service handoff checklist. Ask the operator to inspect that property before replacing keys or changing trust settings, and preserve the intended client/server use beside the certificate identifier so later renewals retain the design decision.\nVerification\nInspect the certificate’s usage extensions and confirm that the intended service can select it. Complete an authorized test handshake from a representative peer with normal validation enabled. Record the role and issuer without copying private-key material into the acceptance evidence or a support ticket.\nOfficial reference\nNetgate — Certificate Management. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:12+00:00", "dateModified": "2026-10-20T18:34:34+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/select-the-pfsense-certificate-purpose-before-troubleshooting-an-unavailable-entry/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Select the pfSense certificate purpose before troubleshooting an unavailable entry" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 250, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — Certificate Management", "url": "https://docs.netgate.com/pfsense/en/latest/certificates/certificate.html" } } ] } }