Pfsense invalid chains after Y generation cert

Your idea sounds likely that maybe this has been broken for a long time and just now it's an issue.