[midlan]

Important notices

Before you submit a pull request, we ask you kindly to acknowledge the following:

• I have read the contributing guidelines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I opened an issue first for non-trivial changes and linked it below. (trivial four-line change, no issue opened)
• AI tools were used to create at least part of the code submitted herewith.

If AI was used, please disclose:

• Model used: Claude Opus 5.5 (via Claude Code)
• Extent of AI involvement: found the issue while reviewing the generated HAProxy files, wrote the patch and the description; tested and reviewed by me on my own installation.

---

Describe the problem

exportCerts.php builds every exported item as certificate + stored private key, regardless of the item type. For a CA that has its private key stored in the trust store (e.g. an internal CA created on OPNsense to issue client certificates), the CA's private key is therefore written into the CA list file /tmp/haproxy/ssl/<id>.calist. That file is used as ca-file for client certificate verification on a public service, and as ca-file for backend server verification.

HAProxy only needs the CA certificates in a ca-file; the private key is never used there. Having it exported means an extra plaintext copy of the CA signing key on disk, which is enough to mint client certificates the frontend would accept.

Steps to reproduce:

1. System: Trust: Authorities, create an internal CA (its private key is stored).
2. HAProxy public service with SSL offloading, Client Certificate Auth enabled, that CA selected under Certificate Authorities.
3. Apply, then grep -c 'PRIVATE KEY' /tmp/haproxy/ssl/*.calist returns 2 (BEGIN/END lines of the CA key).

---

Describe the proposed solution

Only append the private key when exporting items of type cert. CA (and CRL, which already had its own branch) exports then contain just the certificate data plus the linked CA chain, as before.

Tested on OPNsense 26.7.7 with os-haproxy 5.1 (the patched file is identical to current master apart from this change):

• After applying, the .calist contains only the CA certificate, no private key; the server .pem files still contain their key.
• HAProxy reloads, the frontend still advertises the CA in the certificate request.
• A client presenting a certificate issued by that CA is accepted; a client without a certificate is still rejected by the frontend rules.

---

Related issue

None.

---

🤖 Generated with Claude Code