Internet isolated machines fail to upgrade.

[Firstyear]

Hi there,

I have a number of FreeBSD machines within my network so I have a local internal pkg mirror. For the majority of these machines pkgbasify worked flawlessly (thank you!)

However, I have one vlan on my network where internet access is restricted, but internally access to my internal mirror is possible. On these machines pkgbasify fails.

Updating FreeBSD-ports repository catalogue...
Certificate verification failed for /CN=pkg.freebsd.org
1040678A0A640000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
1040678A0A640000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
1040678A0A640000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
1040678A0A640000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
1040678A0A640000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
Certificate verification failed for /CN=pkg.freebsd.org
1040678A0A640000:error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:/usr/src/crypto/openssl/ssl/statem/statem_clnt.c:2125:
pkg: https://pkgmir.geo.freebsd.org/FreeBSD:15:aarch64/quarterly/meta.txz: Authentication error
repository FreeBSD-ports has no meta file, using default settings

So I am not 100% sure if this is a pkgbasify issue or a pkg issue, but it appears that internet access is required even if an internal mirror is used. The internal mirror definition is:

FreeBSD-base: {
  url: "http://HOSTNAME/freebsd/${ABI}/base_release_${VERSION_MINOR}",
  mirror_type: "none",
  signature_type: "fingerprints",
  fingerprints: "/usr/share/keys/pkgbase-${VERSION_MAJOR}",
  enabled: yes
}