Re: pkg update broke

On 7/6/26 12:06 AM, Dan Mahoney (ports) wrote:
> 
> 
>> On Jul 5, 2026, at 9:37 PM, William F. Dudley Jr. <[email protected]> wrote:
>>
>> I am running "FreeBSD 14.3-RELEASE-p16 amd64".
>>
>> I did "freebsd-update fetch" followed by "freebsd-update install", and the power (and my UPS) failed, I think, during the "freebsd-update install" step.
>>
>> Now, when I run "pkg update", I get this:
>>
>> pkg: Failed to fetch https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly/meta.conf: SSL peer certificate or SSH remote key was not OK
>>
>> And identical lines for meta.txz, data.pkg, data.tzst, etc.
>>
>> I have a nearly identical machine, and that machine can do pkg update
>> successfully.
>>
>> I have tried to figure out where pkg stores the SSL certificate or SSH key that it's complaining about but have been unsuccessful.  Running "man pkg", "man pkg.conf", scanning output of "pkg -vv", running "pkg -f bootstrap" all failed to help.
>>
>> What is broken and how can I fix it?
>>
>> Thanks,
>> Bill Dudley
>>
> 
> Okay, try the following:
> 
> openssl s_client -connect pkg.freebsd.org:443
> 
> and see what the verification prints, it should show the results, and I think by default it uses the system cert store.  It should also use the same DNS you're using so should get the same pkg server.
> 
> -Dan

That was "interesting".  Rather than try to understand the output, I ran 
the command on both machines, and they give identical results.

I think this excerpt is the punchline:

SSL handshake has read 2426 bytes and written 401 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 256 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

Thanks,
Bill Dudley