When you install pfSense, its web interface is secured over HTTPS thanks to a self-signed SSL certificate.
However, this is not valid indefinitely and you will therefore have to renew it free of charge when necessary.

1. Expired pfSense certificate
2. Renew the pfSense web interface certificate

1. Expired pfSense certificate

Depending on the web browser you use to access the pfSense interface, it may tell you that the SSL certificate used has expired (as is the case for Microsoft Edge).

Plain Text

The website's security certificate is not yet valid or has expired.
Error Code: DLG_FLAGS_SEC_CERT_DATE_INVALID.

For Mozilla Firefox, it may only show that the certificate is self-signed. Although the certificate is also expired.
To check it, click: View certificate.

As you can see, pfSense's certificate expired in May 2023 and it is currently July 2023 (when writing this tutorial).

2. Renew the pfSense web interface certificate

To renew the pfSense web interface certificate, go to: System -> Cert. Manager.

On the page that appears, go to the tab: Certificates.
As you can see, the certificate used by default by pfSense to secure access to its web interface is the "webConfigurator default" certificate.

Since it has expired, its expiry date appears in red.

To renew the self-signed "webConfigurator default" certificate used by default by pfSense, leave the default settings and click: Renew/Reissue.

Notes :

• Reuse Key: the "Use the existing key" box is checked by default and allows you to renew (extend the validity period) the certificate while keeping the same key pair.
• Strict Security: check the "Enforce strict security parameters" box if you want to use the new security algorithms instead of those currently used by this certificate.
  Updating the certificate's security settings is more secure, but it may be incompatible with older web browsers or computers.

If you want to use the new recommended security settings for the SSL certificate, check the "Enforce strict security parameters" box above and refer to the "Certificate Properties vs Strict Security" table to see what will be changed in your case.

Confirm the renewal of this self-signed certificate by clicking OK.

Plain Text

Are you sure you wish to renew/reissue?

As expected, now our "webConfigurator default" certificate is valid until 2024. So, 1 year and 1 month from today's date.

Note that your web browser may redisplay the warning due to the certificate which is self-signed, once the certificate is renewed.
Ignore this warning as you usually do.