pkg certificates not installed by FreeBSD 15.1 installer

Avernar · Jul 14, 2026

pkg kept showing "pkg: No trusted certificates" and for some operations would constantly complain that and update should be performed (it had been already).

Turns out the files in /usr/share/keys/pkg and /usr/share/keys/pkgbase-15 were never installed by the FreeBSD installer. This is a brand new system installed from the latest USB stick installer.

I had to run pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/base_release_0/FreeBSD-pkg-bootstrap-15.0.pkg to install the missing files. Is this a glitch only I experienced or an issue with the installer?

vladlen · Jul 14, 2026

Avernar said:
pkg kept showing "pkg: No trusted certificates" and for some operations would constantly complain that and update should be performed (it had been already).

Turns out the files in /usr/share/keys/pkg and /usr/share/keys/pkgbase-15 were never installed by the FreeBSD installer. This is a brand new system installed from the latest USB stick installer.

I had to run pkg add -f https://pkg.freebsd.org/FreeBSD:15:amd64/base_release_0/FreeBSD-pkg-bootstrap-15.0.pkg to install the missing files. Is this a glitch only I experienced or an issue with the installer?

Could you provide exact name of the image, I will check it.

Avernar · Jul 15, 2026

vladlen said:
Could you provide exact name of the image, I will check it.

FreeBSD-15.1-RELEASE-amd64-memstick.img

vladlen · Jul 16, 2026

Avernar said:
FreeBSD-15.1-RELEASE-amd64-memstick.img

Iinstalled from this image, bith directories have certificates. Maybe you have some special settings?
I used automatic partitioning of ZFS, most of the other options by default.

Could it be, that you asked:
Would you like to fetch packages from the internet or use the limited set of packages included in this installation media?
and you choose button "Offline (Limited Packages)".

I suspect, that in this case certificates were not copied into /usr/share/keys. I do not know, is it done intentionally or bug.

Avernar · Jul 16, 2026

vladlen said:
Iinstalled from this image, bith directories have certificates. Maybe you have some special settings?
I used automatic partitioning of ZFS, most of the other options by default.

Could it be, that you asked:
Would you like to fetch packages from the internet or use the limited set of packages included in this installation media?
and you choose button "Offline (Limited Packages)".

I suspect, that in this case certificates were not copied into /usr/share/keys. I do not know, is it done intentionally or bug.

No special settings. I also did automatic ZFS and configured my network manually. I can't remember what I picked for the package option. I might have picked the offline option by accident.

The certificates not being on the installation media seems like a security hole. Because it would have to fetch that package with the certs without being able to verify the source authenticity. It's a chicken or egg issue. You need the certs to verify you downloaded legitimate certificates in this case.

geoffmx · Jul 17, 2026

Certificate verification failed for pkg after a fresh install on a Raspberry Pi 3 Model B with
FreeBSD-15.1-RELEASE-arm64-aarch64-RPI.img

Code:

% mdo pkg update
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+https://pkg.FreeBSD.org/FreeBSD:15:aarch64/quarterly, please wait...
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
pkg: Error fetching https://pkg.FreeBSD.org/FreeBSD:15:aarch64/quarterly/Latest/pkg.pkg: Authentication error
A pre-built version of pkg could not be found for your system.
Bootstrapping pkg from pkg+https://pkg.FreeBSD.org/FreeBSD:15:aarch64/kmods_quarterly_1, please wait...
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
pkg: Error fetching https://pkg.FreeBSD.org/FreeBSD:15:aarch64/kmods_quarterly_1/Latest/pkg.pkg: Authentication error
A pre-built version of pkg could not be found for your system.

geoffmx · Jul 17, 2026

geoffmx said:

Certificate verification failed for pkg after a fresh install on a Raspberry Pi 3 Model B with
FreeBSD-15.1-RELEASE-arm64-aarch64-RPI.img

Code:

% mdo pkg update
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+https://pkg.FreeBSD.org/FreeBSD:15:aarch64/quarterly, please wait...
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
pkg: Error fetching https://pkg.FreeBSD.org/FreeBSD:15:aarch64/quarterly/Latest/pkg.pkg: Authentication error
A pre-built version of pkg could not be found for your system.
Bootstrapping pkg from pkg+https://pkg.FreeBSD.org/FreeBSD:15:aarch64/kmods_quarterly_1, please wait...
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
10D0A775D4940000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
pkg: Error fetching https://pkg.FreeBSD.org/FreeBSD:15:aarch64/kmods_quarterly_1/Latest/pkg.pkg: Authentication error
A pre-built version of pkg could not be found for your system.

Turns out that my device system date and time were not in sync after the fresh install. I enabled ntpd and ntpdate in rc.conf and started these services. Then attempted pkg update, and it worked without errors.

Code:

ntpdate_enable="YES"
ntpd_enable="YES"

Avernar · Jul 17, 2026

The certificates I'm referring to are the pkg certificates and not the TLS/SSL certificates.