).
12. Enroll.
**Using certreq.exe (scriptable / automated)** Create an .inf file:
```powershell
[Version]
Signature="$Windows NT$"
[NewRequest]
Subject = "CN=Code Signing, O=SFL Services LLC, L=Loveland, S=Ohio, C=US"
; You can make Subject empty if you prefer only SAN / no CN, but most code signing tools expect a CN
KeySpec = 1
KeyLength = 4096 ; 3072 or 4096 is strongly recommended in 2025+
Exportable = TRUE ; Usually yes for code signing
MachineKeySet = FALSE ; User context (most common for code signing)
SMIME = FALSE
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider"
ProviderType = 24
RequestType = PKCS10
KeyUsage = 0x80 ; digitalSignature = required for code signing
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.3 ; Code Signing EKU
; Optional: if you really want to add DNS SANs (rare for pure code signing)
[Extensions]
2.5.29.17 = "{text}"
_continue_ = "dns=www.sflservicesllc.com&"
_continue_ = "email=sales@sflservicesllc.com"
```
Then:
Create a powershell script **createCert.ps1**, Run the script
**Note:** Change the template name to the name you chose when creating [HERE](https://docs.sflservicesllc.com/books/security/page/security-create-a-code-signing-template "Code Signing Template Create") it with no spaces.
```powershell
certreq -new codesign-request.inf codesign.csr
certutil -dump codesign.csr
certreq -submit -attrib "CertificateTemplate:YourTemplateName" codesign.csr codesign.cer
certreq -accept codesign.cer
certutil -store my
```
# pfSense - Local System Config Backup and send to S3 Buckets
To automate backing up your pfSense configuration to Amazon S3, you can use pfSense's built-in **`rclone` package**. This eliminates the need for complex custom shell scripts because `rclone` can natively authenticate with AWS S3 and encrypt your files.
Here is the step-by-step guide to setting it up.
Step 1: Install the Required Packages
pfSense does not include backup utilities or cron management by default. You need to install them from the Package Manager. [[1](https://www.youtube.com/watch?v=06bsVIwTHbk)]
1.
Log into your pfSense WebGUI.
2.
Navigate to **System** > **Package Manager** > **Available Packages**.
3.
Search for and install **`rclone`**.
4.
Search for and install **`cron`** (this gives you a visual interface to schedule the backup).
Next, create a connection profile (called a "remote") between your pfSense box and your S3 bucket.
1. Connect to your pfSense firewall via **SSH** (or use the WebGUI via **Diagnostics** > **Command Prompt**).
2. Run the rclone configuration tool:```bash
rclone config
```
3. Type **`n`** for "New remote" and name it **`s3-backup`**.
4. When prompted for the storage type, type **`s3`** (or look for the number corresponding to Amazon S3).
5. Choose your S3 provider by typing **`Amazon`** (or press enter for the default AWS S3).
6. Select **`false`** for entering AWS credentials from the env\_auth.
7. Enter your AWS account details when prompted:
- **`access_key_id`**: *Your AWS Access Key*
- **`secret_access_key`**: *Your AWS Secret Key*
8. Select your AWS Region (e.g., `us-east-1`).
9. For all other advanced settings (endpoint, ACLs, encryption), you can press **Enter** to accept the defaults.
10. Type **`y`** to confirm and save the configuration, then **`q`** to quit.
Optional if `rclone` is not available and install `rclone` Manually
#### 1. Download and Extract the Binary
SSH into your pfSense box (or use **Diagnostics** > **Command Prompt**) and execute these commands to download the FreeBSD version of Rclone:
```bash
# 1. Navigate to a temporary folder
cd /tmp
# 2. Download the official FreeBSD 64-bit binary zip archive
fetch https://downloads.rclone.org/v1.75.0/rclone-v1.75.0-freebsd-amd64.zip
# 3. Unzip the downloaded archive
tar -xf rclone-current-freebsd-amd64.zip
```
#### 2. Move `rclone` to the System Path
```bash
# 1. Move the executable binary into your local execution path
mv /tmp/rclone-*-freebsd-amd64/rclone /usr/local/bin/
# 2. Grant execution permissions to the binary file
chmod +x /usr/local/bin/rclone
# 3. Clean up the leftover installation files from /tmp
rm -rf /tmp/rclone-*
```
#### 3. Verify the Installation
Run the version check command to verify it executes perfectly:
```bash
rclone version
```
### Step 3: Create the Backup Script on pfSense
pfSense stores its active configuration file at `/conf/config.xml`. We will write a simple 3-line script to copy this file, timestamp it, and upload it.
1. In the WebGUI, go to **Diagnostics** > **Command Prompt**.
2. In the **Execute Shell Command** box, run this command to create a backup directory:```bash
mkdir -p /root/backups
```
3. Go to **Diagnostics** > **Edit File**.
4. In the **Path to file to edit** box, type: `/root/backup_pfsense.sh` and click **Load**.
5. Paste the following script into the text area:```bash
#!/bin/sh
DATE=$(date +%Y%m%d-%H%M%S)
BACKUP_FILE="/root/backups/pfsense-config-${DATE}.xml"
# 1. Copy the live config to the local backup folder
cp /conf/config.xml "${BACKUP_FILE}"
# 2. Push the file to your S3 bucket (replace "your-bucket-name" with your actual bucket)
/usr/local/bin/rclone copy "${BACKUP_FILE}" s3-backup:your-bucket-name/pfsense/
# 3. Clean up local files older than 7 days to save space on pfSense
find /root/backups/ -name "pfsense-config-*.xml" -type f -mtime +7 -delete
```
6. Click **Save**.
7. Go back to **Diagnostics** > **Command Prompt** and make the script executable by running:```bash
chmod +x /root/backup_pfsense.sh
```
*(Optional Testing: You can test if it works right now by running `/root/backup_pfsense.sh` in the Command Prompt box and checking your S3 bucket).*
Step 4: Schedule the Automation with Cron
Now, use the Cron package you installed in Step 1 to make this run automatically every day.
1.
Navigate to **Services** > **Cron** in the WebGUI. \[[1](https://opennix.org/en/docs/pfsense/development/pfsense-custom-scripts/)\]
2.
Click **+ Add** to create a new cron job.
3.
Configure the schedule (e.g., to run daily at 3:00 AM):
-
**Minute**: `0`
-
**Hour**: `3`
-
**Day of the Month**: `*`
-
**Month**: `*`
-
**Day of the Week**: `*`
-
**User**: `root`
-
**Command**: `/root/backup_pfsense.sh`
4.
Click **Save**.
🔒 Security Warning for pfSense Backups
Your `config.xml` file contains your firewall's root password hashes, VPN private keys, and network topology.
- **Encrypt the Remote Bucket:** Ensure your S3 bucket has Server-Side Encryption (SSE) turned on.
- **Alternative (Rclone Encryption):** If you want absolute zero-knowledge security, you can run `rclone config` again, add a new remote of type **`crypt`**, and point it at `s3-backup:your-bucket-name`. This will encrypt the file locally on pfSense *before* it touches AWS infrastructure.