Fix 'freenas_default' Certificate Expired on TrueNAS

The alert reads:

Certificate ‘freenas_default’ has expired.

or, a few days earlier:

Certificate ‘freenas_default’ is expiring within 2 days.

It appears in the TrueNAS alert bell, in the daily alert email, and, once expired, as a browser warning every time you open the web UI. It is not dangerous by itself, and your data and shares are unaffected. It does mean the certificate that secures the admin interface is no longer valid, and that TrueNAS will keep nagging until you replace it.

What freenas_default is

When TrueNAS (CORE or SCALE, and FreeNAS before it) is installed, it generates a private certificate authority called freenas_default and a certificate signed by that CA, also called freenas_default. The certificate is assigned to the web UI so that HTTPS works out of the box. Its subject is localhost and it is self-signed, so browsers never trusted it in the first place; you have always been clicking through a warning, or connecting over plain HTTP.

That certificate has a fixed lifetime of a little over a year. Nothing renews it. When it expires, TrueNAS raises the alert, and Chrome switches from “certificate not trusted” to NET::ERR_CERT_DATE_INVALID, which is harder to click past.

Fix option 1: Generate a new internal certificate (5 minutes)

This is the direct replacement. It is still self-signed, so browsers still warn, but the alert clears and you get a fresh year.

TrueNAS SCALE:

1. Go to Credentials → Certificates.
2. Under Certificate Authorities, click Add. Type: Internal CA. Give it a name such as nas-ca, fill in the organisation fields, and save. (You can also reuse the existing freenas_default CA; it usually has a longer lifetime than the certificate it signed. Check its expiry in the list.)
3. Under Certificates, click Add. Type: Internal Certificate. Name it nas-2026, choose the CA from step 2, set a lifetime (up to 397 days is the safe maximum modern browsers accept), and add your NAS hostname and IP under Subject Alternative Name. Save.
4. Go to System Settings → General → GUI, set GUI SSL Certificate to nas-2026, and save. The UI restarts.
5. Back in Credentials → Certificates, delete the old freenas_default certificate. The alert clears on the next alert run, or immediately if you dismiss it.

TrueNAS CORE / FreeNAS:

The steps are identical; the menus are System → CAs, System → Certificates, and System → General → GUI SSL Certificate.

Optionally, import your new CA’s public certificate into your workstation’s trust store (Keychain on macOS, “Trusted Root Certification Authorities” on Windows) so the browser stops warning. Download it from the CA’s row in the Certificates page.

Fix option 2: Get a real certificate with ACME (recommended if the NAS has a domain name)

If you access the NAS through a hostname on a domain you control, TrueNAS can obtain a free Let’s Encrypt certificate and renew it automatically, which ends this alert permanently. It uses the DNS-01 challenge, so the NAS does not need to be reachable from the internet, but your DNS provider must be one TrueNAS supports (Cloudflare and Amazon Route 53 are built in; others work through a shell script authenticator).

TrueNAS SCALE:

1. Credentials → Certificates → ACME DNS-Authenticators → Add. Choose your provider and enter its API token.
2. Credentials → Certificates → Certificate Signing Requests → Add. Type: Certificate Signing Request. Common name: the NAS hostname, e.g. nas.example.com. Save.
3. On the new CSR’s row, click Create ACME Certificate. Pick the authenticator, accept the terms, set Renew Certificate Days to 10 or more, and set the directory URI to Let’s Encrypt production. Save.
4. System Settings → General → GUI → set GUI SSL Certificate to the ACME certificate.
5. Delete freenas_default as above.

TrueNAS now renews the certificate itself. You can verify the served certificate at any time from another machine:

echo | openssl s_client -connect nas.example.com:443 -servername nas.example.com 2>/dev/null \
  | openssl x509 -noout -dates -issuer

If you just want the alert gone

Click the bell icon, then Dismiss on the alert. It will come back only if the certificate is still expired at the next check, so dismissal without replacement lasts until the next alert cycle. Replacing the certificate is a five-minute job; do that instead.

Things that go wrong

• “Certificate is not valid until…” after creating a new one. The NAS clock is behind. Check System Settings → General → Localization and confirm NTP servers are set and reachable.
• The UI became unreachable after switching certificate. Connect over http:// (the UI listens on both by default), or use the console menu on the NAS to reset the GUI settings, then pick the certificate again.
• Apps or services still use the old certificate. Services that were assigned freenas_default explicitly (S3, WebDAV, FTP over TLS, some Apps) need the new certificate selected in their own settings before you can delete the old one; TrueNAS refuses to delete a certificate that is still in use and tells you where.
• ACME fails with a DNS error. The API token lacks the permission to edit DNS records for the zone, or the zone is not on the provider you chose. Test the token from the provider’s dashboard first.

The underlying lesson

A NAS is the sort of box that gets set up once and then trusted for years, which is exactly how a one-year certificate expires unnoticed. TrueNAS at least warns you. Most web servers, hosting panels, and CDNs do not, and the first sign of an expired certificate on a public site is a customer complaining. If you also run websites, the same expiry problem is covered in Certificate has expired: how to fix it on any platform, and the process for catching it early is in SSL certificate expiration monitoring.

FAQ

Is my data at risk when Certificate ‘freenas_default’ has expired? No. The expired certificate only affects the web interface’s HTTPS. Your pools, shares, apps and services keep running. The alert is noise about a certificate nobody ever trusted, not a failure of the NAS.

Can I just dismiss the alert instead of replacing the certificate? You can, and it will stay dismissed until the next alert run re-checks the still-expired certificate. It comes back. Replacing the certificate takes about five minutes and ends it.

What is the difference between an internal certificate and an ACME certificate? An internal certificate is self-signed by your own CA, so browsers still show a warning and you get a fixed lifetime you manage yourself. An ACME certificate comes from Let’s Encrypt, browsers trust it, and TrueNAS renews it automatically — but it needs a domain name you control and DNS API access.

Do I need a domain name to fix this? No. Option 1 generates an internal certificate and works on a bare IP or hostname. ACME (option 2) needs a real domain name, and it is the only option that ends both the alert and the browser warning for good.

Can I delete the old freenas_default certificate straight away? Not always. TrueNAS refuses to delete a certificate that is still assigned, and it names the service holding it — usually S3, WebDAV, FTP over TLS or an App. Repoint those to the new certificate first, then delete the old one.

Why does the browser say NET::ERR_CERT_DATE_INVALID instead of the old warning? An expired self-signed certificate is treated differently from an untrusted one. Before expiry Chrome let you click through “certificate not trusted”. Once the date passes it hard-blocks with NET::ERR_CERT_DATE_INVALID, which is why the problem gets worse the longer you leave it.

Will this happen again? Yes, once a year, unless you use ACME. The internal certificate has a fixed lifetime and nothing renews it. An ACME certificate renews itself, so the alert does not come back.

For a public site, SitesRadar’s free plan checks the served certificate every day and emails at 30, 14, and 7 days before expiry, so the alert arrives while there is still time to act rather than after the browser has started blocking visitors.