I noticed that after changing the intermediate certificate to R12 and R13, the PFX file generated by my client no longer includes the intermediate certificate used by the domain cert. We didn't make any recent changes to the client code, so I assume it was something in the issuance process. Any cl…

[image] grudnitzki1: so I assume it was something in the issuance process. See Switching issuance to new intermediates

Intermediates have been rotated, but they didn't mention any other changes.

I think you'd need to be really clear on what client you're using, and how you've configured it to make a pfx file. In general, ACME clients would read the intermediate along with the new certificate and deploy it the same way. It sounds that isn't working for you automatically, but you haven't prov…

@grudnitzki1 Which ACME client are you using? I think there were versions of Certes (an older ACME library) that could have been affected but that was mainly around roots rather than intermediates.

[image] petercooperjr: but you haven't provided much information for people to help you None to be exact. The fact their client hardcodes the intermediates suggests it's an issue with their own code.. Not sure what OP expects from us or from Let's Encrypt :crystal_ball: If LE were somehow s…

I developed my own client, using Chilkat components. The client does not hardcode the intermediates. The client creates a PFX file with the domain cert. After the rotation of the secondary certs, the PFXs are still working fine but missing the intermediates in the file.

[image] grudnitzki1: The client creates a PFX file with the domain cert The "cert" returned by Let's Encrypt contains both the leaf and its intermediate. You must be losing that when you convert it to pfx. Carefully review your conversion code. It is not technically impossible for LE to no…

[image] grudnitzki1: The client creates a PFX file with the domain cert. After the rotation of the secondary certs, the PFXs are still working fine but missing the intermediates in the file. How does your client currently source the intermediates? Generally when you build a PFX you create an …

The solution was to also include the root certificate (ISRG Root X1) in the PFX file generated by my client. This way, the intermediate certificate was automatically included as well. Thanks for the suggestions that pointed me in the right direction.

Uh... the receiver of your cert is supposed to have the root certificate in their trust store. You including the root certificate in your served chain defeats the purpose.

New intermediary certs not included in PFX

Help

Bruce5051 August 22, 2025, 10:43pm 2

See Switching issuance to new intermediates

Topic		Replies	Views
Renewal not include intermidiate Help	17	1774	May 7, 2020
Iintermediate certificates E7, E8, R12, R13 PEMs Help	11	5779	August 11, 2025
Generating Certificates on Windows and Exporting to pfSense - Missing Intermediates Help	19	8341	May 12, 2017
How convert pem to pfx and also generate intermidiate certificates chain Help	3	1816	January 15, 2025
Note regarding transition to R3 intermediate with Firefox or Thunderbird Help	3	2007	December 9, 2020

New intermediary certs not included in PFX

Related topics