I have the same issue as well. ACME renewed on my pfsense and now all my systems show the same issue that they are revoked. Nothing I tried worked, had to just revert to my old certs for now.

The short answer is Yes... just use the one in /tmp/acme/ At this point, I would hold off on calling it a bug until we understand the intent of the package maintainers. What we've now confirmed is that acme.sh is obtaining the complete chain correctly. Both of us see four certificates present in: …

[image] blknight88: Unless I did something wrong, concatenating [domain].cer followed by ca.cer is the same as the fullchain and ca.cer. No unless [domain].cer and fullchain.cer have the same content. But they don't based on what you've sent us. Based on this: [image] blknight88: so if …

The certificate you posted is a YE2 certificate issued on May 31. However, an external OpenSSL test currently sees an E8 certificate issued on May 1. Where is the May 31 certificate installed, and what device is actually serving HTTPS for books.circuitbrick.net ?

I don't normally do this manually so I missed moving the new test fullchain I made before running Ansible. An openssl test should show the YE2 cert now

[image] blknight88: An openssl test should show the YE2 cert now Yes, it does. Yeah, as @dextercd noted the fullchain file should be just as the ACME Client received it from Let's Encrypt. It then has to split it to make your leaf cert and ca.cer. Usually these days servers use the fullcha…

I think the certificate itself may be a distraction at this point. The original OpenSSL test was seeing the older E8 certificate. After you moved the new fullchain and reran things, OpenSSL started seeing the YE2 certificate. So that part seems explained. What I'm trying to understand now is the w…

The workflow is: pfsense runs the ACME package to get the cert and then pfsense runs a local script to copy the fullchain and key to my reverse proxy and that same script also does an API call to run an Ansible playbook in my Semaphore server which copies the cert from the reverse proxy to my publi…

Now that we understand the workflow, I think we're finally looking in the right place. One thing I've found useful over the years is treating the ACME output as source material rather than immediately deploying it everywhere. In my environment I do some validation and processing first, then deploy…

[image] Rip: In my case the server ends up presenting only the leaf certificate and intermediate Have you updated to the Y series yet? Because using riptidetech.io I see the prior generation

Good catch. riptidetech.io is still on the E-series chain. The testing I've been referring to was done against yachats-gardens.com after moving to the Y-series hierarchy. That's actually what prompted me to revisit my deployment script and verification logic in the first place. Even there, the se…

Pfsense invalid chains after Y generation cert

Help

blknight88 June 1, 2026, 3:20am 27

Your idea sounds likely that maybe this has been broken for a long time and just now it's an issue.

Topic		Replies	Views
After renewal, fullchain.pem only contains server certificate Help	43	1770	April 6, 2024
Certbot fullchain missing intermediates Help	11	271	June 5, 2026
Bad com renewing certificate Help	27	274	September 13, 2024
Issue - Unable to verify certificate chain - CentOS7 Help	34	4721	August 6, 2022
Help thread with cremationlab Help	100	2490	November 4, 2021

Pfsense invalid chains after Y generation cert

Related topics