2.9.0 New Features and Changes | pfSense Documentation
Netgate Logo
Netgate Docs
Appliances
Platforms
Support
Training
Docs "
pfSense® software "
Releases
Give Feedback
Next
26.07 New Features and Changes
Previous
Releases
2.9.0 New Features and Changes¶
This is a regularly scheduled software release including new features and bug<br>fixes.
Tip
Review the Upgrade Guide before performing<br>any upgrade of pfSense software.
General¶
Base OS updated to FreeBSD 16-CURRENT
OpenSSL upgraded to 3.5.7
OpenSSH upgraded to 10.3p1
PHP updated to 8.5.7
SSH Algorithms¶
This release includes several changes to algorithms for the SSH daemon for key<br>exchange, encryption, and message authentication. These changes increase<br>security by including post-quantum key exchange algorithms and by removing older<br>and weaker algorithms.
The current set of SSH server algorithms are supported by most SSH, SCP, and<br>SFTP clients released in the last several years, but some older or specialized<br>clients may fail to connect. Ensure all client software is fully up-to-date<br>before upgrading to this version of pfSense software.
If a client does not connect to the SSH daemon on this version, please post on<br>the Netgate Forum and include the full client name and version.
TLS Certificate Strength¶
The version of OpenSSL in this release further tightens certificate requirements<br>and removes support for certain weak properties. For example, if a TLS server<br>certificate for a service such as the GUI has a weak key (Such weak certificates have been deprecated for some time and the GUI has warned<br>against using weak settings, however, if the certificates were generated on<br>other systems and imported, or generated years ago with long lifetimes, users<br>may not realize such certificates are now considered insecure.
This version of pfSense software checks the GUI certificate during the upgrade<br>process and will re-generate a new GUI certificate if the current certificate is<br>invalid, expired, or weak.
Even with that automatic check, the best practice is to inspect all server<br>certificates before upgrading. Navigate to the System > Certificates ,<br>Certificates tab. On that page, check each TLS server certificate by<br>clicking the Renew/Reissue icon. On the renewal<br>screen, inspect the Certificate Properties vs Strict Security table. If any<br>items in the Would Change column are Yes , then either renew the<br>certificate with Strict Security checked, or create/import a replacement<br>certificate which meets these standards.
If the Renew/Reissue icon is not available for a<br>certificate, such as for those imported from an external CA, use the<br>icon to view the certificate properties and check the values<br>manually.
See also
Renew or Reissue a CA or Certificate
HTTPS Certificate Problems
TLS Server Certificate Lifetime¶
CA/Browser forum baseline requirements<br>are calling for shorter TLS server certificate validity periods to be phased in<br>over the next few years and the current period is a maximum of 200 days for<br>server certificates issued between March 15, 2026, and March 15, 2027.
To follow those recommendations, this release lowers the recommended secure<br>server certificate lifetime from 398 days to 200 days.
Note
This value is only a recommendation, not a strict limitation. Users may<br>opt to use longer lifetimes by manually entering the lifetime value of their<br>choice.
TLS Certificate Auto-Renew¶
This version of pfSense software can automatically renew TLS server certificates which are self-signed or signed by an<br>internal CA stored in the pfSense software configuration. Automatic renewal is a<br>per-certificate option, and pfSense software automatically enables this option<br>for the GUI certificate when possible. When automatically renewing a<br>certificate, pfSense software uses the latest strict security options to ensure<br>the certificate meets current standards.
While many operating systems and browsers will ignore strict validity<br>requirements for self-signed certificates or certificates signed by a custom CA,<br>some do not. Allowing GUI certificates to expire will result in the GUI<br>being unreachable in those cases.
Users can edit the GUI certificate entry and disable the automatic renewal<br>option if it does not suit their environment.
While the option is not automatically enabled for other TLS server certificates,<br>it is generally safe to enable it manually. For example, TLS server certificates<br>for OpenVPN servers can safely auto-renew.
See also
Automatic Renewal
Automatic Static Link-Local Address¶
Previous releases automatically added the fe80::1:1 link-local address to<br>interfaces configured for IPv6 tracking. This behavior was causing problems for<br>some users and was not offering many, if any, tangible benefits in modern<br>environments.
If clients used this automatic address for link-local traffic, users may need to<br>update their configurations to use other link-local addresses after upgrading.
Endpoint-independent Port Restricted Cone Outbound...