Certificates – a brief introduction

OPNsense uses certificates to ensure secure communication between nodes in services such as OpenVPN and IPsec, and HTTP services such as Captive Portal, web proxies, and WebGUI.

The available types of certificates in OPNsense are the following:

• Certificate Authority (CA): A CA is a trusted entity that issues trusted certificates. On OPNsense, this will be used to issue self-signed certificates.
• Server type certificate: This certificate must be used on the server side of encrypted communication. On OPNsense, you will enable it in services such as OpenVPN or WebGUI, for example.
• Client type certificate: This type of certificate will be used on the other side of client-server encrypted communication. On OPNsense, we use it, for example, on OpenVPN clients' certificates and on some plugins such as NGINX or HAProxy.
• Combined Client/Server: This type of certificate can be used on both the server side and client side.
...