Running FreeBSD on OCI: Marketplace Deployment, Upgrade to 15.1, Apache, PF Firewall, and Let's Encrypt

FreeBSD is available in the OCI Marketplace as a partner image published by The FreeBSD Foundation. FreeBSD 15.0 introduced official OCI images, and the FreeBSD 15.1 release notes state that 15.0-RELEASE was the last release for which the FreeBSD Project published OCI-specific images. This creates an interesting cloud operations pattern: launch the supported Marketplace image, identify how its base system is managed, then upgrade it using the official FreeBSD 15.1 procedure.

Lifecycle point: FreeBSD 15.0-RELEASE reaches its expected end of life on 30 September 2026. FreeBSD 15.1-RELEASE, released on 16 June 2026, is expected to be supported until 31 March 2027. For a new article published now, treat the 15.0 Marketplace image as the deployment starting point and 15.1 as the operational target.

Version-sensitive point: Marketplace build names, compatible shapes, package flavors, and OCI console labels can change.

Target architecture

Select FreeBSD from OCI Partner Images

1. Open OCI Console and go to Compute > Instances.

2. Click Create instance.

3. In the Image and shape section, click Change image.

4. Select Partner images.

5. Enter FreeBSD in the search box and click Search.

6. Select the FreeBSD listing published by The FreeBSD Foundation.

7. Open the Image build dropdown and select the required FreeBSD 15.0-RELEASE build. For this reference lab, select the ARM64 ZFS build.

8. Review Software Details if required.

9. Select the checkbox confirming that you reviewed and accept the Oracle Terms of Use, Partner terms and conditions, and Oracle General Privacy Policy.

10. Click Select image.

OCI Console – Create Instance / Change Image dialog

I am using one existing VCN with public subnet. Downloaded generated SSH keys.

Instance running – OCI Console instance details

FreeBSD is now running. I have updated the vNIC with a reserved public IP and also assigned one existing NSG.

Logged in via ssh, using the username "freebsd" and the generated SSH key.

SSH terminal – initial login

Record the initial system state

whoami

uname -a

freebsd-version -kru

uname -m

uname -p

zpool status

zfs list

bectl list

ifconfig

netstat -rn

sudo -n id

Initial system state command output

Protect the Pre-Upgrade System

The reference image is ZFS-based, so create a boot environment before the 15.1 upgrade. This provides a local rollback point from the FreeBSD boot menu.

sudo bectl list

sudo bectl create -r pre-15.1

sudo bectl list

bectl list – boot environment created

Identify the FreeBSD Upgrade Method

FreeBSD 15.1 uses two documented binary-upgrade paths. Do not choose the path by assumption. Detect how the base system is managed with the following command:

pkg which /usr/bin/uname

pkg which output confirming packaged base

Upgrade a Packaged-Base System to FreeBSD 15.1

Update the current 15.0 base

sudo pkg upgrade -r FreeBSD-base

pkg upgrade -r FreeBSD-base output

Upgrade the base system to 15.1

sudo pkg -oABI=FreeBSD:15:$(uname -p) -oOSVERSION=1501000 upgrade -r FreeBSD-base

pkg upgrade to 15.1 output

Review every package message. If the command proposes unexpected removals, stop and capture the output before proceeding.

Update third-party kernel modules if present

sudo pkg upgrade -r FreeBSD-ports-kmods

pkg upgrade FreeBSD-ports-kmods output

If the repository or package set is not used, pkg can report that nothing needs to be upgraded.

Find configuration files that could not be merged automatically

sudo find /etc /usr/local/etc -name '*.pkgnew' -ls

find command listing .pkgnew files

For every .pkgnew file found, compare it with the active configuration and merge the required changes before rebooting.

Upgrade the UEFI Boot Loader on ARM64

Why this is included: FreeBSD 15.1 upgrade instructions require the UEFI boot loader to be updated. AArch64 systems use UEFI. The active EFI System Partition and loader path must be identified on the running instance before copying files.

Identify the active EFI loader and ESP

sudo efibootmgr -v

mount | grep '/boot/efi' || true

gpart show

In efibootmgr output, identify the active entry and the EFI path. Do not invent the disk device. Use the device/path shown by your instance.

Mount the ESP if it is not already mounted

If /boot/efi is already mounted, skip this command. Otherwise replace <ESP_DEVICE> with the EFI System Partition identified above:

sudo mount_msdosfs /dev/<ESP_DEVICE> /boot/efi

Copy the new ARM64 loader

The official 15.1 instructions use these AArch64 destinations. Confirm the directory case and the active path from efibootmgr first; create missing destination directories only when they match the intended boot layout.

sudo cp /boot/loader.efi /boot/efi/efi/freebsd/loader.efi

sudo cp /boot/loader.efi /boot/efi/efi/boot/bootaa64.efi

Reboot

sudo shutdown -r now

Validate FreeBSD 15.1 After Reboot

freebsd-version -kru

uname -a

uname -m

uname -p

zpool status

bectl list

ifconfig

netstat -rn

The kernel and userland should report FreeBSD 15.1-RELEASE. Keep the pre-15.1 boot environment until the lab has passed all validation steps.

freebsd@freebsd-test:~ $ freebsd-version -kru

15.1-RELEASE-p3

freebsd@freebsd-test:~ $ uname -a

FreeBSD freebsd-test 15.1-RELEASE-p3 FreeBSD 15.1-RELEASE-p3 releng/15.1-n283611-88e7371d9dc2 GENERIC arm64

freebsd@freebsd-test:~ $ uname -m

arm64

freebsd@freebsd-test:~ $ uname -p

aarch64

freebsd@freebsd-test:~ $ zpool status

pool: zroot

state: ONLINE

config:

NAME STATE READ WRITE CKSUM

zroot ONLINE 0 0 0

da0p3 ONLINE 0 0 0

errors: No known data errors

freebsd@freebsd-test:~ $ bectl list

BE Active Mountpoint Space Created

default NR / 5.71G 1970-01-01 05:30

post-15.1-pre-reboot - - 21.1M 2026-09-16 12:13

freebsd@freebsd-test:~ $ ifconfig

vtnet0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 9000

options=ec07bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS>

ether 02:00:17:31:ef:fc

inet 10.0.10.154 netmask 0xffffff00 broadcast 10.0.10.255

media: Ethernet autoselect (10Gbase-T <full-duplex>)

status: active

nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

lo0: flags=1008049<UP,LOOPBACK,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 16384

options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>

inet 127.0.0.1 netmask 0xff000000

inet6 ::1 prefixlen 128

inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2

groups: lo

nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

freebsd@freebsd-test:~ $ netstat -rn

Routing tables

Internet:

Destination Gateway Flags Netif Expire

default 10.0.10.1 UGS vtnet0

10.0.10.0/24 link#1 U vtnet0

10.0.10.154 link#2 UHS lo0

127.0.0.1 link#2 UH lo0

169.254.0.0/16 link#1 US vtnet0

Internet6:

Destination Gateway Flags Netif Expire

::/96 link#2 URS lo0

::1 link#2 UHS lo0

::ffff:0.0.0.0/96 link#2 URS lo0

fe80::%lo0/10 link#2 URS lo0

fe80::%lo0/64 link#2 U lo0

fe80::1%lo0 link#2 UHS lo0

ff02::/16 link#2 URS lo0

freebsd@freebsd-test:~ $

Install Apache 2.4

FreeBSD's current Handbook uses the www/apache24 package for Apache HTTP Server.

Install it:

sudo pkg install apache24

When prompted:

Proceed with this action? [y/N]:

enter:

pkg install apache24 output

Enable Apache during boot

Run:

sudo sysrc apache24_enable="YES"

Verify:

sysrc apache24_enable

Expected:

apache24_enable: YES

Start Apache

sudo service apache24 start

Then:

sudo service apache24 status

Verify Apache configuration

Run:

sudo service apache24 configtest

Expected:

Syntax OK

apachectl configtest – Syntax OK

FreeBSD documents /usr/local/etc/apache24/httpd.conf as the Apache configuration file and /usr/local/www/apache24/data/ as the default web content location.

Check listening ports

Run:

sudo sockstat -4 -6 -l | grep httpd

You should see Apache listening on TCP port 80.

Also:

curl -I http://127.0.0.1

A healthy response should include something similar to:

HTTP/1.1 200 OK

Server: Apache/2.4...

Test the default page locally

curl http://127.0.0.1

curl localhost response – Apache default page

At this stage, do not configure PF yet. First we will confirm Apache works locally, open TCP/80 in the OCI NSG, verify public HTTP access, and only then introduce the host firewall. This gives us a clean troubleshooting boundary.

Edit Apache:

sudo vi /usr/local/etc/apache24/httpd.conf

Find the existing commented example:

#ServerName www.example.com:80

Change it to:

ServerName freebsd-test:80

Save the file.

Then:

sudo service apache24 configtest

The expected result is simply:

Syntax OK

Reload Apache:

sudo service apache24 reload

Replace the default page with the lab microsite

First preserve the original:

sudo cp /usr/local/www/apache24/data/index.html /usr/local/www/apache24/data/index.html.original

Now create:

sudo vi /usr/local/www/apache24/data/index.html

paste the following -

<!DOCTYPE html>

<head>

<title>FreeBSD 15.1 on Oracle Cloud Infrastructure</title>

<style>

body {

margin: 0;

font-family: Arial, Helvetica, sans-serif;

background: #f4f5f7;

color: #252525;

}

header {

background: #ab2b28;

color: white;

padding: 45px 20px;

text-align: center;

}

header h1 {

margin: 0;

font-size: 36px;

}

header p {

margin-top: 12px;

font-size: 18px;

}

main {

max-width: 900px;

margin: 40px auto;

background: white;

padding: 35px;

border-radius: 8px;

box-shadow: 0 3px 12px rgba(0,0,0,0.10);

}

h2 {

color: #ab2b28;

}

.status {

background: #edf7ed;

border-left: 5px solid #3c763d;

padding: 16px;

margin-bottom: 30px;

}

table {

width: 100%;

border-collapse: collapse;

margin-bottom: 30px;

}

td {

padding: 11px;

border-bottom: 1px solid #dddddd;

}

td:first-child {

font-weight: bold;

width: 35%;

}

footer {

text-align: center;

color: #666;

margin-top: 35px;

font-size: 14px;

}

</style>

</head>

<body>

<h1>FreeBSD on Oracle Cloud Infrastructure</h1>

<p>FreeBSD 15.1 running on OCI ARM64</p>

</header>

<main>

Apache HTTP Server is running successfully.

</div>

<h2>Lab Environment</h2>

<table>

<tr>

<td>Cloud Platform</td>

<td>Oracle Cloud Infrastructure</td>

</tr>

<tr>

<td>Operating System</td>

<td>FreeBSD 15.1-RELEASE-p3</td>

</tr>

<tr>

<td>Architecture</td>

<td>ARM64 / AArch64</td>

</tr>

<tr>

<td>Filesystem</td>

</tr>

<tr>

<td>Web Server</td>

<td>Apache HTTP Server 2.4</td>

</tr>

<tr>

<td>Host Firewall</td>

</tr>

<tr>

<td>Timezone</td>

<td>Asia/Kolkata</td>

</tr>

</table>

<h2>About This Lab</h2>

<p>

This FreeBSD virtual machine was deployed from the

FreeBSD Partner Image available through Oracle Cloud

Infrastructure Marketplace.

</p>

<p>

The original FreeBSD 15.0 Marketplace image was upgraded

to FreeBSD 15.1 using the FreeBSD pkgbase upgrade process.

</p>

<p>

This lab covers FreeBSD on OCI, ZFS, Apache HTTP Server,

PF firewall configuration and HTTPS with Let's Encrypt.

</p>

FreeBSD on Oracle Cloud Infrastructure | Hands-On Lab

</footer>

</main>

</body>

</html>

save and exit vim

validate new page-

freebsd@freebsd-test:~ $ clear

freebsd@freebsd-test:~ $ sudo service apache24 configtest

Performing sanity check on apache24 configuration:

Syntax OK

freebsd@freebsd-test:~ $ sudo service apache24 reload

Performing sanity check on apache24 configuration:

Syntax OK

Performing sanity check on apache24 configuration:

Syntax OK

Performing a graceful restart

freebsd@freebsd-test:~ $ curl -I http://127.0.0.1

HTTP/1.1 200 OK

Date: Wed, 16 Sep 2026 07:15:34 GMT

Server: Apache/2.4.68 (FreeBSD)

Last-Modified: Wed, 16 Sep 2026 07:13:52 GMT

ETag: "c88-65b9468cfe368"

Accept-Ranges: bytes

Content-Length: 3208

Content-Type: text/html

freebsd@freebsd-test:~ $ curl http://127.0.0.1

<!DOCTYPE html>

<head>

<title>FreeBSD 15.1 on Oracle Cloud Infrastructure</title>

<style>

body {

margin: 0;

font-family: Arial, Helvetica, sans-serif;

background: #f4f5f7;

color: #252525;

}

header {

background: #ab2b28;

color: white;

padding: 45px 20px;

text-align: center;

}

header h1 {

margin: 0;

font-size: 36px;

}

header p {

margin-top: 12px;

font-size: 18px;

}

main {

max-width: 900px;

margin: 40px auto;

background: white;

padding: 35px;

border-radius: 8px;

box-shadow: 0 3px 12px rgba(0,0,0,0.10);

}

h2 {

color: #ab2b28;

}

.status {

background: #edf7ed;

border-left: 5px solid #3c763d;

padding: 16px;

margin-bottom: 30px;

}

table {

width: 100%;

border-collapse: collapse;

margin-bottom: 30px;

}

td {

padding: 11px;

border-bottom: 1px solid #dddddd;

}

td:first-child {

font-weight: bold;

width: 35%;

}

footer {

text-align: center;

color: #666;

margin-top: 35px;

font-size: 14px;

}

</style>

</head>

<body>

<h1>FreeBSD on Oracle Cloud Infrastructure</h1>

<p>FreeBSD 15.1 running on OCI ARM64</p>

</header>

<main>

Apache HTTP Server is running successfully.

</div>

<h2>Lab Environment</h2>

<table>

<tr>

<td>Cloud Platform</td>

<td>Oracle Cloud Infrastructure</td>

</tr>

<tr>

<td>Operating System</td>

<td>FreeBSD 15.1-RELEASE-p3</td>

</tr>

<tr>

<td>Architecture</td>

<td>ARM64 / AArch64</td>

</tr>

<tr>

<td>Filesystem</td>

</tr>

<tr>

<td>Web Server</td>

<td>Apache HTTP Server 2.4</td>

</tr>

<tr>

<td>Host Firewall</td>

</tr>

<tr>

<td>Timezone</td>

<td>Asia/Kolkata</td>

</tr>

</table>

<h2>About This Lab</h2>

<p>

This FreeBSD virtual machine was deployed from the

FreeBSD Partner Image available through Oracle Cloud

Infrastructure Marketplace.

</p>

<p>

The original FreeBSD 15.0 Marketplace image was upgraded

to FreeBSD 15.1 using the FreeBSD pkgbase upgrade process.

</p>

<p>

This lab covers FreeBSD on OCI, ZFS, Apache HTTP Server,

PF firewall configuration and HTTPS with Let's Encrypt.

</p>

FreeBSD on Oracle Cloud Infrastructure | Hands-On Lab

</footer>

</main>

</body>

</html>

freebsd@freebsd-test:~ $

Open TCP/80 at OCI level

Before configuring PF, expose HTTP through the OCI network layer.

Go to:

OCI Console → Compute → Instances → freebsd-test → Attached VNICs

Open the VNIC and identify the NSG attached to it.

Add an ingress rule:

Setting Value

Source type CIDR

Source CIDR 0.0.0.0/0

IP protocol TCP

Source port All

Destination port 80

Description FreeBSD Apache HTTP

Keep SSH restricted to your administrative public IP rather than 0.0.0.0/0.

PF configuration file content

Now test from a browser - http://<OCI-PUBLIC-IP>. The lab page will display

Browser test of lab page over public IP

If PF is disabled, you may see:

pfctl: /dev/pf: No such file or directory

or an inactive status depending on how the Marketplace image is configured.

Also check:

sysrc pf_enable

freebsd@freebsd-test:~ $ sudo pfctl -s info

pfctl: /dev/pf: No such file or directory

freebsd@freebsd-test:~ $ sysrc pf_enable

pf_enable: NO

freebsd@freebsd-test:~ $

Now we will create the pf file

sudo vi /etc/pf.conf then paste the below contents-

ext_if = "vtnet0"

admin_ip = "203.163.248.178" >> replace this with your workstations public ip

set skip on lo0

set block-policy drop

# Default inbound policy

block in log all

# Allow all traffic initiated by this server

pass out all keep state

# Preserve DHCP for the OCI VNIC

pass in quick on $ext_if inet proto udp from any port 67 to any port 68 keep state

# Allow IPv4 ICMP for diagnostics

pass in quick on $ext_if inet proto icmp from any to ($ext_if) keep state

# SSH only from the current administrative public IP

pass in quick on $ext_if inet proto tcp from $admin_ip to ($ext_if) port 22 flags S/SA keep state

# Public web services

pass in quick on $ext_if inet proto tcp from any to ($ext_if) port 80 flags S/SA keep state

pass in quick on $ext_if inet proto tcp from any to ($ext_if) port 443 flags S/SA keep state

same and exit

Review the file before loading PF

Run:

sudo cat /etc/pf.conf, confirm your workstations public ip is mentioned correctly

Load the PF kernel module only

Do not enable filtering yet.

sudo kldload pf

Verify:

kldstat | grep pf

Then:

sudo pfctl -s info

Validate the rules without applying them

Run:

sudo pfctl -vnf /etc/pf.conf

Do not continue if you see an error.

You should see the expanded rules, including SSH from:

203.163.248.178

and TCP ports:

443

Keep your existing SSH session open

Do not close the current SSH session.

Also keep the OCI Console Connection available.

Open a second terminal window on your workstation, but do not connect yet.

Load the rules while PF remains disabled

Run:

sudo pfctl -f /etc/pf.conf

Then inspect the loaded rules:

sudo pfctl -sr

You should see the same effective rules you just validated.

Also check that PF is still disabled:

sudo pfctl -s info

At this point it should still say:

Status: Disabled

Test a second SSH session

Test the website again

From your workstation browser open:

http://132.226.30.224

Inspect the PF state table

After opening the second SSH connection and reloading the webpage:

freebsd@freebsd-test:~ $ sudo pfctl -s states

all tcp 10.0.10.154:80 <- 91.230.168.87:34197 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 91.230.168.180:43815 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:22 <- 203.163.248.178:39440 ESTABLISHED:ESTABLISHED

all tcp 10.0.10.154:80 <- 203.163.248.178:1408 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 203.163.248.178:37107 FIN_WAIT_2:ESTABLISHED

all tcp 10.0.10.154:80 <- 203.163.248.178:7129 ESTABLISHED:ESTABLISHED

freebsd@freebsd-test:~ $ sudo pfctl -s states | egrep ':22|:80|:443'

all tcp 10.0.10.154:22 <- 203.163.248.178:39440 ESTABLISHED:ESTABLISHED

all tcp 10.0.10.154:80 <- 203.163.248.178:1408 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 203.163.248.178:37107 FIN_WAIT_2:ESTABLISHED

all tcp 10.0.10.154:80 <- 203.163.248.178:7129 FIN_WAIT_2:ESTABLISHED

freebsd@freebsd-test:~ $ sudo pfctl -vvsr

No ALTQ support in kernel

ALTQ related functions disabled

@0 block drop in log all

[ Evaluations: 39 Packets: 19 Bytes: 1516 States: 0 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 0 ]

[ Last Active Time: Wed Sep 16 13:20:53 2026 ]

@1 pass out all flags S/SA keep state

[ Evaluations: 39 Packets: 2 Bytes: 152 States: 1 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 1 ]

[ Last Active Time: Wed Sep 16 13:21:06 2026 ]

@2 pass in quick on vtnet0 inet proto tcp from 203.163.248.178 to (vtnet0:1) port = ssh flags S/SA keep state

[ Evaluations: 39 Packets: 79 Bytes: 15495 States: 1 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 1 ]

[ Last Active Time: Wed Sep 16 13:21:12 2026 ]

@3 pass in quick on vtnet0 inet proto tcp from any to (vtnet0:1) port = http flags S/SA keep state

[ Evaluations: 25 Packets: 53 Bytes: 8045 States: 3 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 6 ]

[ Last Active Time: Wed Sep 16 13:21:08 2026 ]

@4 pass in quick on vtnet0 inet proto tcp from any to (vtnet0:1) port = https flags S/SA keep state

[ Evaluations: 19 Packets: 0 Bytes: 0 States: 0 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 0 ]

[ Last Active Time: N/A ]

@5 pass in quick on vtnet0 inet proto icmp from any to (vtnet0:1) keep state

[ Evaluations: 19 Packets: 0 Bytes: 0 States: 0 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 0 ]

[ Last Active Time: N/A ]

@6 pass in quick on vtnet0 inet proto udp from any port = bootps to any port = bootpc keep state

[ Evaluations: 19 Packets: 0 Bytes: 0 States: 0 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 0 ]

[ Last Active Time: N/A ]

freebsd@freebsd-test:~ $

Make PF persistent only after both tests succeed

freebsd@freebsd-test:~ $ sudo sysrc pf_enable="YES"

pf_enable: NO -> YES

freebsd@freebsd-test:~ $ sysrc pf_enable

pf_enable: YES

freebsd@freebsd-test:~ $ sudo sysrc pflog_enable="YES"

pflog_enable: NO -> YES

freebsd@freebsd-test:~ $ sudo service pflog start

Starting pflog.

freebsd@freebsd-test:~ $ grep -E 'sshd_enable|ifconfig_vtnet0|apache24_enable|pf_enable|pflog_enable' /etc/rc.conf

sshd_enable=YES

ifconfig_vtnet0=DHCP

apache24_enable="YES"

pf_enable="YES"

pflog_enable="YES"

freebsd@freebsd-test:~ $

Reboot persistence test

After everything above works:

sudo shutdown -r now

After reconnecting:

sudo pfctl -s info

sudo pfctl -sr

sudo service apache24 status

Then test again from the workstation:

http://132.226.30.224

Browser test via public DNS hostname

Now lets update the FQDN and use a public DNS mapping. I have a domain with GoDaddy and I have added one "A" record. Its resolving now.

freebsd@freebsd-test:~ $ getent hosts freebsd.debapriyabiswas.in

132.226.30.224 freebsd.debapriyabiswas.in

freebsd@freebsd-test:~ $

Change Apache from the temporary name to the FQDN

The FreeBSD Handbook documents ServerName as the Apache hostname directive and /usr/local/etc/apache24/httpd.conf as the main configuration file.

Check your current setting:

grep -n '^ServerName' /usr/local/etc/apache24/httpd.conf

Edit:

sudo vi /usr/local/etc/apache24/httpd.conf

Set:

ServerName freebsd.debapriyabiswas.in:80

Then:

sudo service apache24 configtest

Expected:

Syntax OK

Reload:

sudo service apache24 reload

Create a proper Apache VirtualHost

First check whether the FreeBSD Apache package loads the Includes directory:

grep -nE 'Include.*Includes' /usr/local/etc/apache24/httpd.conf

If you see an Includes/*.conf entry, create:

sudo vi /usr/local/etc/apache24/Includes/freebsd.conf

Use:

ServerName freebsd.debapriyabiswas.in

DocumentRoot "/usr/local/www/apache24/data"

Options Indexes FollowSymLinks

AllowOverride None

Require all granted

</Directory>

ErrorLog "/var/log/freebsd-error.log"

CustomLog "/var/log/freebsd-access.log" combined

</VirtualHost>

Validate:

sudo service apache24 configtest

Then inspect Apache's virtual-host mapping:

sudo apachectl -S

You should see freebsd.debapriyabiswas.in associated with *:80.

Reload:

sudo service apache24 reload

Apache reload confirmation

Test by hostname over HTTP

From your workstation:

curl.exe -I http://freebsd.debapriyabiswas.in

You want:

HTTP/1.1 200 OK

Then browse to:

http://freebsd.debapriyabiswas.in

Your existing FreeBSD microsite should appear.

curl.exe -I http://freebsd.debapriyabiswas.in

HTTP/1.1 200 OK

Date: Wed, 16 Sep 2026 08:43:48 GMT

Server: Apache/2.4.68 (FreeBSD)

Last-Modified: Wed, 16 Sep 2026 07:13:52 GMT

ETag: "c88-65b9468cfe368"

Accept-Ranges: none

Content-Length: 3208

Content-Type: text/html

curl response headers over hostname

Verify OCI TCP/443

Your PF rules already contain:

pass in ... port = https

and its counters were 0, which is expected before TLS is configured.

In OCI, ensure the NSG attached to this VNIC has:

Source CIDR 0.0.0.0/0

Protocol TCP

Destination Port 443

Description FreeBSD HTTPS

Keep TCP/80 open as well. HTTP is useful for ACME HTTP-01 validation and later redirects to HTTPS.

OCI NSG ingress rule for TCP/443

Check the current Certbot packages before installation

FreeBSD's current ports tree provides Certbot and an Apache plugin. The 2026Q3 Certbot package for FreeBSD 15 uses Python 3.12 on supported architectures.

Run:

pkg search certbot

sudo pkg install security/py-certbot security/py-certbot-apache

Then:

certbot --version

and:

sudo certbot plugins

certbot plugins output

Run a staging certificate test first

Once DNS definitely resolves to 132.226.30.224, run:

sudo certbot certonly --apache --dry-run -d freebsd.debapriyabiswas.in

This tests the ACME process against the staging CA.

If it succeeds, request the production certificate:

sudo certbot --apache -d freebsd.debapriyabiswas.in

Certbot will ask for an email address and agreement to the Let's Encrypt terms.

When asked about redirecting HTTP to HTTPS, select the redirect option.

The Apache plugin is intended to request and install the certificate directly into Apache configuration.

I found that some of the Apache modules are not active, we need to activate/enable them.

sudo vi /usr/local/etc/apache24/httpd.conf

Uncomment these four lines:

LoadModule authn_socache_module libexec/apache24/mod_authn_socache.so

LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so

LoadModule ssl_module libexec/apache24/mod_ssl.so

LoadModule rewrite_module libexec/apache24/mod_rewrite.so

Then validate:

sudo service apache24 configtest

Expected:

Syntax OK

If that succeeds, reload Apache:

sudo service apache24 reload

then check the modules again -

freebsd@freebsd-test:~ $ sudo apachectl -M | egrep 'rewrite|ssl|socache'

authn_socache_module (shared)

socache_shmcb_module (shared)

ssl_module (shared)

rewrite_module (shared)

freebsd@freebsd-test:~ $

Then try certbot staging request-

sudo certbot certonly --apache --dry-run -d freebsd.debapriyabiswas.in

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Unable to read ssl_module file; not disabling session tickets.

Certbot has detected that apache version < 2.4.11 or compiled against openssl < 1.0.2l. Since these are deprecated, the configuration file being installed at /usr/local/etc/letsencrypt/options-ssl-apache.conf will not receive future updates. To get the latest configuration version, update apache.

Simulating a certificate request for freebsd.debapriyabiswas.in

The dry run was successful.

freebsd@freebsd-test:~ $

The staging test succeeded, so ACME validation for freebsd.debapriyabiswas.in is working. Certbot reached Let's Encrypt staging, validated the hostname, and completed the simulated request.

The warnings about reading ssl_module did not stop issuance. [Inference] This appears to come from Certbot's Apache-plugin inspection on FreeBSD rather than your Apache version itself, because you are running Apache 2.4.68 and the staging request completed. We can verify the linked SSL library later.

Now request the real certificate and let Certbot install it into Apache. Certbot documents that certonly obtains a certificate without installing it, while the normal --apache run obtains and installs it.

Run:

freebsd@freebsd-test:~ $ sudo certbot --apache -d freebsd.debapriyabiswas.in

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Unable to read ssl_module file; not disabling session tickets.

Enter email address or hit Enter to skip.

(Enter 'c' to cancel): debapriya.biswas@live.in

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please read the Terms of Service at:

https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf

You must agree in order to register with the ACME server. Do you agree?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Would you be willing, once your first certificate is successfully issued, to

share your email address with the Electronic Frontier Foundation, a founding

partner of the Let's Encrypt project and the non-profit organization that

develops Certbot? We'd like to send you email about our work encrypting the web,

EFF news, campaigns, and ways to support digital freedom.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: y

Account registered.

Requesting a certificate for freebsd.debapriyabiswas.in

Successfully received certificate.

Certificate is saved at: /usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/fullchain.pem

Key is saved at: /usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/privkey.pem

This certificate expires on 2026-12-15.

These files will be updated when the certificate renews.

Deploying certificate

Successfully deployed certificate for freebsd.debapriyabiswas.in to /usr/local/etc/apache24/Includes/freebsd-le-ssl.conf

Congratulations! You have successfully enabled HTTPS on https://freebsd.debapriyabiswas.in

NEXT STEPS:

The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See https://certbot.org/renewal-setup for instructions.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

If you like Certbot, please consider supporting our work by:

* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

* Donating to EFF: https://eff.org/donate-le

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

freebsd@freebsd-test:~ $

Validate Apache configuration

freebsd@freebsd-test:~ $ sudo service apache24 configtest

Performing sanity check on apache24 configuration:

Syntax OK

freebsd@freebsd-test:~ $ sudo apachectl -S

VirtualHost configuration:

*:80 freebsd.debapriyabiswas.in (/usr/local/etc/apache24/Includes/freebsd.conf:1)

*:443 is a NameVirtualHost

default server freebsd.debapriyabiswas.in (/usr/local/etc/apache24/Includes/freebsd-le-ssl.conf:2)

port 443 namevhost freebsd.debapriyabiswas.in (/usr/local/etc/apache24/Includes/freebsd-le-ssl.conf:2)

ServerRoot: "/usr/local"

Main DocumentRoot: "/usr/local/www/apache24/data"

Main ErrorLog: "/var/log/httpd-error.log"

Mutex rewrite-map: using_defaults

Mutex ssl-stapling-refresh: using_defaults

Mutex ssl-stapling: using_defaults

Mutex ssl-cache: using_defaults

Mutex authn-socache: using_defaults

Mutex default: dir="/var/run/" mechanism=default

Mutex mpm-accept: using_defaults

PidFile: "/var/run/httpd.pid"

Define: DUMP_VHOSTS

Define: DUMP_RUN_CFG

User: name="www" id=80

Group: name="www" id=80

freebsd@freebsd-test:~ $ sudo sockstat -4 -6 -l | grep httpd

www httpd 4933 3 tcp6 *:80 *:*

www httpd 4933 4 tcp4 *:80 *:*

www httpd 4933 5 tcp6 *:443 *:*

www httpd 4933 6 tcp4 *:443 *:*

www httpd 4930 3 tcp6 *:80 *:*

www httpd 4930 4 tcp4 *:80 *:*

www httpd 4930 5 tcp6 *:443 *:*

www httpd 4930 6 tcp4 *:443 *:*

www httpd 4929 3 tcp6 *:80 *:*

www httpd 4929 4 tcp4 *:80 *:*

www httpd 4929 5 tcp6 *:443 *:*

www httpd 4929 6 tcp4 *:443 *:*

www httpd 4928 3 tcp6 *:80 *:*

www httpd 4928 4 tcp4 *:80 *:*

www httpd 4928 5 tcp6 *:443 *:*

www httpd 4928 6 tcp4 *:443 *:*

www httpd 4927 3 tcp6 *:80 *:*

www httpd 4927 4 tcp4 *:80 *:*

www httpd 4927 5 tcp6 *:443 *:*

www httpd 4927 6 tcp4 *:443 *:*

www httpd 4926 3 tcp6 *:80 *:*

www httpd 4926 4 tcp4 *:80 *:*

www httpd 4926 5 tcp6 *:443 *:*

www httpd 4926 6 tcp4 *:443 *:*

www httpd 4925 3 tcp6 *:80 *:*

www httpd 4925 4 tcp4 *:80 *:*

www httpd 4925 5 tcp6 *:443 *:*

www httpd 4925 6 tcp4 *:443 *:*

root httpd 2981 3 tcp6 *:80 *:*

root httpd 2981 4 tcp4 *:80 *:*

root httpd 2981 5 tcp6 *:443 *:*

root httpd 2981 6 tcp4 *:443 *:*

freebsd@freebsd-test:~ $ sudo certbot certificates

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Found the following certs:

Certificate Name: freebsd.debapriyabiswas.in

Serial Number: 68cd363a75feb0c75067f38fa36305ccb48

Key Type: ECDSA

Domains: freebsd.debapriyabiswas.in

Expiry Date: 2026-12-15 09:00:16+00:00 (VALID: 89 days)

Certificate Path: /usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/fullchain.pem

Private Key Path: /usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/privkey.pem

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

freebsd@freebsd-test:~ $

freebsd@freebsd-test:~ $ curl -I http://freebsd.debapriyabiswas.in

HTTP/1.1 301 Moved Permanently

Date: Wed, 16 Sep 2026 10:05:22 GMT

Server: Apache/2.4.68 (FreeBSD) OpenSSL/3.5.6

Location: https://freebsd.debapriyabiswas.in/

Content-Type: text/html; charset=iso-8859-1

freebsd@freebsd-test:~ $ curl -I https://freebsd.debapriyabiswas.in

HTTP/1.1 200 OK

Date: Wed, 16 Sep 2026 10:05:38 GMT

Server: Apache/2.4.68 (FreeBSD) OpenSSL/3.5.6

Last-Modified: Wed, 16 Sep 2026 07:13:52 GMT

ETag: "c88-65b9468cfe368"

Accept-Ranges: bytes

Content-Length: 3208

Content-Type: text/html

freebsd@freebsd-test:~ $ openssl s_client \

> -connect freebsd.debapriyabiswas.in:443 \

> -servername freebsd.debapriyabiswas.in </dev/null 2>/dev/null | \

> openssl x509 -noout -subject -issuer -dates

subject=CN=freebsd.debapriyabiswas.in

issuer=C=US, O=Let's Encrypt, CN=YE1

notBefore=Sep 16 09:00:17 2026 GMT

notAfter=Dec 15 09:00:16 2026 GMT

freebsd@freebsd-test:~ $

freebsd@freebsd-test:~ $ sudo certbot renew --dry-run

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Processing /usr/local/etc/letsencrypt/renewal/freebsd.debapriyabiswas.in.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Unable to read ssl_module file; not disabling session tickets.

Simulating renewal of an existing certificate for freebsd.debapriyabiswas.in

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all simulated renewals succeeded:

/usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/fullchain.pem (success)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

freebsd@freebsd-test:~ $

PF state table – active connections

freebsd@freebsd-test:~ $ sudo pfctl -s states | egrep ':22|:80|:443'

all tcp 10.0.10.154:22 <- 203.163.248.178:38331 ESTABLISHED:ESTABLISHED

all tcp 10.0.10.154:17847 -> 172.65.46.172:443 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 66.133.109.36:39659 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 18.237.176.35:46184 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 3.144.162.221:54242 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 54.179.116.208:22762 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 13.49.231.59:20260 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:443 <- 203.163.248.178:13690 TIME_WAIT:TIME_WAIT

all tcp 10.0.10.154:443 <- 203.163.248.178:19122 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:80 <- 203.163.248.178:62053 FIN_WAIT_2:FIN_WAIT_2

all tcp 10.0.10.154:443 <- 158.69.117.45:16788 TIME_WAIT:TIME_WAIT

freebsd@freebsd-test:~ $ sudo pfctl -vvsr

No ALTQ support in kernel

ALTQ related functions disabled

@0 block drop in log all

[ Evaluations: 444 Packets: 112 Bytes: 4872 States: 0 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 0 ]

[ Last Active Time: Wed Sep 16 15:37:10 2026 ]

@1 pass out all flags S/SA keep state

[ Evaluations: 444 Packets: 59800 Bytes: 59512765 States: 1 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 109 ]

[ Last Active Time: Wed Sep 16 15:36:48 2026 ]

@2 pass in quick on vtnet0 inet proto tcp from 203.163.248.178 to (vtnet0:1) port = ssh flags S/SA keep state

[ Evaluations: 444 Packets: 3339 Bytes: 421343 States: 1 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 1 ]

[ Last Active Time: Wed Sep 16 15:38:10 2026 ]

@3 pass in quick on vtnet0 inet proto tcp from any to (vtnet0:1) port = http flags S/SA keep state

[ Evaluations: 313 Packets: 965 Bytes: 162156 States: 6 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 106 ]

[ Last Active Time: Wed Sep 16 15:37:51 2026 ]

@4 pass in quick on vtnet0 inet proto tcp from any to (vtnet0:1) port = https flags S/SA keep state

[ Evaluations: 207 Packets: 1740 Bytes: 571025 States: 3 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 95 ]

[ Last Active Time: Wed Sep 16 15:37:51 2026 ]

@5 pass in quick on vtnet0 inet proto icmp from any to (vtnet0:1) keep state

[ Evaluations: 133 Packets: 44 Bytes: 2204 States: 0 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 21 ]

[ Last Active Time: Wed Sep 16 15:31:45 2026 ]

@6 pass in quick on vtnet0 inet proto udp from any port = bootps to any port = bootpc keep state

[ Evaluations: 112 Packets: 0 Bytes: 0 States: 0 ]

[ Source Nodes: 0 Limit: 0 NAT/RDR: 0 Route: 0 ]

[ Inserted: uid 0 pid 0 State Creations: 0 ]

[ Last Active Time: N/A ]

freebsd@freebsd-test:~ $

Now will configure automated certificate renewal -

First check whether the installed FreeBSD package supplied a periodic task:

freebsd@freebsd-test:~ $ sudo find /usr/local/etc/periodic -type f -iname '*certbot*' -print

/usr/local/etc/periodic/weekly/500.certbot-3.12

freebsd@freebsd-test:~ $ pkg info | grep -i certbot

py312-certbot-4.2.0,2 Let's Encrypt client

py312-certbot-apache-4.2.0 Apache plugin for Certbot

freebsd@freebsd-test:~ $ sudo grep -v '^#' /usr/local/etc/periodic/weekly/*certbot* 2>/dev/null

if [ -r /etc/defaults/periodic.conf ]

then

. /etc/defaults/periodic.conf

source_periodic_confs

case "$weekly_certbot_enable" in

[Yy][Ee][Ss])

echo

echo "Renewing Let's Encrypt certificates:"

PRE_HOOK=""

POST_HOOK=""

DEPLOY_HOOK=""

if [ -n "$weekly_certbot_service" ] && \

[ -z "$weekly_certbot_pre_hook" ] && [ -z "$weekly_certbot_post_hook" ];

then

if service "$weekly_certbot_service" onestatus

then

PRE_HOOK="--pre-hook 'service $weekly_certbot_service onestop'"

POST_HOOK="--post-hook 'service $weekly_certbot_service onestart'"

else

if [ -n "$weekly_certbot_pre_hook" ]; then

PRE_HOOK="--pre-hook '$weekly_certbot_pre_hook'"

if [ -n "$weekly_certbot_post_hook" ]; then

POST_HOOK="--post-hook '$weekly_certbot_post_hook'"

if [ -n "$weekly_certbot_deploy_hook" ]; then

DEPLOY_HOOK="--deploy-hook '$weekly_certbot_deploy_hook'"

anticongestion

eval /usr/local/bin/certbot-3.12 renew "$PRE_HOOK" "$POST_HOOK" \

"$DEPLOY_HOOK" "$weekly_certbot_custom_args" --no-random-sleep-on-renew

if [ $? -gt 0 ]

then

echo

echo "Errors were reported when renewing Let's Encrypt certificate(s)."

rc=3

else

rc=0

;;

*) rc=0;;

esac

exit $rc

freebsd@freebsd-test:~ $

For Apache, the cleanest configuration is to enable weekly renewal and reload Apache only when Certbot actually renews a certificate.

Edit /etc/periodic.conf:

sudo vi /etc/periodic.conf

Add:

weekly_certbot_enable="YES"

weekly_certbot_deploy_hook="service apache24 reload"

Save the file.

Then verify:

sudo cat /etc/periodic.conf

weekly_certbot_enable="YES"

weekly_certbot_deploy_hook="service apache24 reload"

freebsd@freebsd-test:~ $

Confirm that the Python 3.12 Certbot executable referenced by the periodic script exists:

ls -lh /usr/local/bin/certbot*

lrwxr-xr-x 1 root wheel 12B Aug 28 10:26 /usr/local/bin/certbot -> certbot-3.12

-rwxr-xr-x 1 root wheel 220B Aug 28 10:26 /usr/local/bin/certbot-3.12

freebsd@freebsd-test:~ $

Check when FreeBSD runs the weekly periodic jobs:

freebsd@freebsd-test:~ $ grep periodic /etc/crontab

1 3 * * * root periodic daily

15 4 * * 6 root periodic weekly

30 5 1 * * root periodic monthly

freebsd@freebsd-test:~ $

Test the FreeBSD periodic Certbot script directly:

sudo /usr/local/etc/periodic/weekly/500.certbot-3.12

Renewing Let's Encrypt certificates:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Processing /usr/local/etc/letsencrypt/renewal/freebsd.debapriyabiswas.in.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

The following certificates are not due for renewal yet:

/usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/fullchain.pem expires on 2026-12-15 (skipped)

No renewals were attempted.

No hooks were run.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

freebsd@freebsd-test:~ $

After the periodic configuration is in place, I would do one last reboot:

sudo shutdown -r now

After reconnecting, verify the complete solution:

freebsd@freebsd-test:~ $ freebsd-version -kru

15.1-RELEASE-p3

freebsd@freebsd-test:~ $ sudo service apache24 status

apache24 is running as pid 2864.

freebsd@freebsd-test:~ $ sudo pfctl -s info

Status: Enabled for 0 days 00:00:55 Debug: Urgent

State Table Total Rate

current entries 5

searches 185 3.4/s

inserts 5 0.1/s

removals 0 0.0/s

Counters

match 5 0.1/s

bad-offset 0 0.0/s

fragment 0 0.0/s

short 0 0.0/s

normalize 0 0.0/s

memory 0 0.0/s

bad-timestamp 0 0.0/s

congestion 0 0.0/s

ip-option 0 0.0/s

proto-cksum 0 0.0/s

state-mismatch 0 0.0/s

state-insert 0 0.0/s

state-limit 0 0.0/s

src-limit 0 0.0/s

synproxy 0 0.0/s

map-failed 0 0.0/s

translate 0 0.0/s

freebsd@freebsd-test:~ $ sudo service pflog status

pflog is running as pid 448.

freebsd@freebsd-test:~ $ curl -I http://freebsd.debapriyabiswas.in

HTTP/1.1 301 Moved Permanently

Date: Wed, 16 Sep 2026 10:18:03 GMT

Server: Apache/2.4.68 (FreeBSD) OpenSSL/3.5.6

Location: https://freebsd.debapriyabiswas.in/

Content-Type: text/html; charset=iso-8859-1

freebsd@freebsd-test:~ $ curl -I https://freebsd.debapriyabiswas.in

HTTP/1.1 200 OK

Date: Wed, 16 Sep 2026 10:18:11 GMT

Server: Apache/2.4.68 (FreeBSD) OpenSSL/3.5.6

Last-Modified: Wed, 16 Sep 2026 07:13:52 GMT

ETag: "c88-65b9468cfe368"

Accept-Ranges: bytes

Content-Length: 3208

Content-Type: text/html

freebsd@freebsd-test:~ $ sudo certbot certificates

Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Found the following certs:

Certificate Name: freebsd.debapriyabiswas.in

Serial Number: 68cd363a75feb0c75067f38fa36305ccb48

Key Type: ECDSA

Domains: freebsd.debapriyabiswas.in

Expiry Date: 2026-12-15 09:00:16+00:00 (VALID: 89 days)

Certificate Path: /usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/fullchain.pem

Private Key Path: /usr/local/etc/letsencrypt/live/freebsd.debapriyabiswas.in/privkey.pem

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

freebsd@freebsd-test:~ $

Authoritative References

FreeBSD 15.1 Upgrade Instructions: https://www.freebsd.org/releases/15.1R/upgrading/

FreeBSD 15.1 Release Notes: https://www.freebsd.org/releases/15.1R/relnotes/

FreeBSD Security / Supported Releases: https://www.freebsd.org/security/

FreeBSD Handbook - Firewalls / PF: https://docs.freebsd.org/en/books/handbook/firewalls/

FreeBSD Handbook - Network Servers / Apache: https://docs.freebsd.org/en/books/handbook/network-servers/

FreeBSD Handbook - Network / Hostname: https://docs.freebsd.org/en/books/handbook/network/

About the Author

Mr. Debapriya Biswas

Oracle ACE | Sr. Consultant – Cloud Technologies

Focused on OCI Compute, Networking, and Automation

Search This Blog

The Geek Life