Possible chain issue?

Help
1

I've been having some issues with my Mastodon instance for about two days, and it seems like the issues started at the same time my SSL cert renewed. I'm also seeing some SSL errors accessing it from my phone ("Trust anchor for certificate path not found") although everything seems OK from the browser.

I have an ACME certificate plugin on my pfSense firewall that I use to renew my certs, which has been working fine for multiple domains for several years now. I'm using the fullchain file it generates in my nginx configuration.

When I test my domain in the Qualys checker (SSL Server Test (Powered by Qualys SSL Labs)), it tells me:

This server's certificate chain is incomplete. Grade capped to B.

But the Namecheap SSL checker (SSL Checker) shows:

No, we were unable to detect any issues in the certificate chain sent by the server

If I use the openssl command from my local system, it shows an error getting the local issuer cert:

$ openssl s_client -connect mastodon.slightlycyberpunk.com:443 -servername mastodon.slightlycyberpunk.com
Connecting to 46.226.107.212
CONNECTED(00000003)
depth=1 C=US, O=Let's Encrypt, CN=YR2
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN=slightlycyberpunk.com
verify return:1
---
Certificate chain
 0 s:CN=slightlycyberpunk.com
   i:C=US, O=Let's Encrypt, CN=YR2
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Jun 15 13:13:43 2026 GMT; NotAfter: Sep 13 13:13:42 2026 GMT
 1 s:C=US, O=Let's Encrypt, CN=YR2
   i:C=US, O=ISRG, CN=Root YR
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2028 GMT
---

I don't know if it had any of these errors prior to the new cert being issued, but it seems like there's some issues with the cert chain which I would like to get resolved regardless.

I also just checked one of the other domains that I generate certs for using the same process. It did not have any chain issues using a cert issued last August, but after renewing the cert it is also now showing these same incomplete chain issues. Looks like the issuer changed from R13 to YR2.

The domain is mastodon.slightlycyberpunk.com
Hosted on a Gandi VPS
Nginx version: nginx/1.22.1
OS version: Debian Bookworm [ Linux mastodon 6.1.0-9-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.27-1 (2023-05-08) x86_64 GNU/Linux ]

2

I just tried regenerating the cert with a Preferred Chain flag of "R13" but I'm still getting a cert from YR2...not sure if that's an issue with the generation script not taking the flag properly or if there's some other reason it can't generate on that chain....

3

Double-check that. It sounds like you may be using only one or two of the certificates in that file, instead of all of them.

The preferred chain lets you pick a different path to a different root, but not a different intermediate. The intermediates change regularly, and so as long as you're using the full chain that the server presents it shouldn't matter what one you use. You'd only want a different preferred chain if you knew your clients could use a newer root like ISRG Root X2.

4

You should review this topic. There is a problem with pfSense dropping all but the first intermediate in the chain.

5

Yep, that pfSense issue was it. THANK YOU, I've spent so many hours trying to sort this out and never suspected that plugin because I've been using it for years without encountering this issue...now to go update my scripts...