Well, you hid your fully qualified domain name so I can't verify this is the specific problem but it is almost certainly related to this pfSense issue.
I'll note that you are using an RSA cert so should have 3 certs in your "fullchain". The post above was using an ECDSA cert so should have 4 in "fullchain".