From the console (option 8) or Diagnostics → Command Prompt:

1
2
3
4
5
6

certctl rehash
pkg-static clean -ay
pkg-static install -fy pkg
pkg-static install -xfy pfSense-repo pfSense-upgrade
pkg-static update -f
pfSense-upgrade -d -c        # shows which version the configured branch offers

With pkg alive again, finish the pending upgrade through System → Update (or pfSense-upgrade -d), not with pkg upgrade.

The error

1

ld-elf.so.1: Shared object "libssl.so.30" not found, required by "pkg"

You see it on pkg update, when installing a package, or indirectly: System → Package Manager shows up empty and System → Update cannot check versions. Sometimes the binary complaining is pfSense-repoc instead of pkg; it is the same problem.

Why it happens

pfSense is FreeBSD, and pkg is a binary dynamically linked against the system’s libssl. When the configured repository belongs to a pfSense release built on a newer FreeBSD, its packages come linked against a newer OpenSSL (libssl.so.30 = OpenSSL 3). If pkg, or pfSense-repoc, gets updated from that repo before the base system, the new binary asks for a library that does not exist on your install yet.

How you get there:

• A manual pkg upgrade from the shell. On pfSense you never do that.
• Installing or reinstalling a package after switching the Branch in System → Update to a higher version, without upgrading.
• An upgrade interrupted halfway (typical in the 2.7.0 → 2.7.1/2.7.2 jump, when the base moved to OpenSSL 3).
• On pfSense Plus, rolling back to an older boot environment with the repo pointing at the new one (Redmine #15070).

The library name will change across releases; the mechanics and the fix stay the same.

Fix

pkg-static is the statically linked copy of pkg: it needs no libssl, which is why it works when pkg does not.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 1. Let pkg-static talk TLS to the repo (holds until the next reboot)
certctl rehash

# 2. Drop the cache and reinstall pkg and the repo configuration
pkg-static clean -ay
pkg-static install -fy pkg
pkg-static install -xfy pfSense-repo pfSense-upgrade   # -x: regex, so pfSense-repoc comes along

# 3. Refresh metadata and check
pkg-static update -f
pfSense-upgrade -d -c

If pkg-static update still fails, pkg-static -d update prints the full trace (certificates, DNS, wrong branch).

Before step 3 check the Branch under System → Update: it must be the version you want to reach, not an intermediate one. And finish the job through the GUI or with pfSense-upgrade -d: a stray pkg upgrade leaves you halfway again.

If the base system is so mixed up that even this does not fly, Netgate’s documented last resort is pkg-static upgrade -f (reinstalls everything), followed by a reboot.

Traps

• pkg upgrade does not exist on pfSense. The only supported path is System → Update / pfSense-upgrade. This whole situation is born from skipping it.
• Backup first: Diagnostics → Backup & Restore. On ZFS, also a boot environment (System → Boot Environments) lets you roll back in one reboot.
• Do not copy libssl.so.30 from another FreeBSD. It circulates as a trick; it leaves the system with libraries from two releases and breaks the next upgrade.
• Packages first, no. With an upgrade pending, upgrade the system and then install packages, not the other way around.
• The repo and the upgrade use HTTPS: if certctl rehash is not enough, check the firewall’s system time and DNS.

Reference: Upgrade Troubleshooting in the Netgate documentation.