# Possible chain issue? **URL:** \ **Category:** Help\ **Created:** [June 15, 2026, 4:54pm UTC](https://community.letsencrypt.org/t/possible-chain-issue/248210 "2026-06-15T16:54:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![slightlycyberpunk](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@slightlycyberpunk](https://community.letsencrypt.org/u/slightlycyberpunk)\ **Post date:** [June 15, 2026, 4:54pm UTC](https://community.letsencrypt.org/t/possible-chain-issue/248210/1 "2026-06-15T16:54:43Z")
I've been having some issues with my Mastodon instance for about two days, and it seems like the issues started at the same time my SSL cert renewed. I'm also seeing some SSL errors accessing it from my phone ("Trust anchor for certificate path not found") although everything seems OK from the browser. I have an ACME certificate plugin on my pfSense firewall that I use to renew my certs, which has been working fine for multiple domains for several years now. I'm using the fullchain file it generates in my nginx configuration. When I test my domain in the Qualys checker ([SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html)), it tells me: > ``` > This server's certificate chain is incomplete. Grade capped to B. > > ``` But the Namecheap SSL checker ([SSL Checker](https://decoder.link/sslchecker/)) shows: > ``` > No, we were unable to detect any issues in the certificate chain sent by the server > > ``` If I use the openssl command from my local system, it shows an error getting the local issuer cert: ```nohighlight $ openssl s_client -connect mastodon.slightlycyberpunk.com:443 -servername mastodon.slightlycyberpunk.com Connecting to 46.226.107.212 CONNECTED(00000003) depth=1 C=US, O=Let's Encrypt, CN=YR2 verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 CN=slightlycyberpunk.com verify return:1 --- Certificate chain 0 s:CN=slightlycyberpunk.com i:C=US, O=Let's Encrypt, CN=YR2 a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption v:NotBefore: Jun 15 13:13:43 2026 GMT; NotAfter: Sep 13 13:13:42 2026 GMT 1 s:C=US, O=Let's Encrypt, CN=YR2 i:C=US, O=ISRG, CN=Root YR a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption v:NotBefore: Sep 3 00:00:00 2025 GMT; NotAfter: Sep 2 23:59:59 2028 GMT --- ``` I don't know if it had any of these errors prior to the new cert being issued, but it seems like there's some issues with the cert chain which I would like to get resolved regardless. I also just checked one of the other domains that I generate certs for using the same process. It did not have any chain issues using a cert issued last August, but after renewing the cert it is also now showing these same incomplete chain issues. Looks like the issuer changed from R13 to YR2. The domain is [mastodon.slightlycyberpunk.com](http://mastodon.slightlycyberpunk.com) Hosted on a Gandi VPS Nginx version: nginx/1.22.1 OS version: Debian Bookworm [Linux mastodon 6.1.0-9-amd64 #1 SMP PREEMPT\_DYNAMIC Debian 6.1.27-1 (2023-05-08) x86\_64 GNU/Linux] ---
**Author:** ![slightlycyberpunk](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@slightlycyberpunk](https://community.letsencrypt.org/u/slightlycyberpunk)\ **Post date:** [June 15, 2026, 5:12pm UTC](https://community.letsencrypt.org/t/possible-chain-issue/248210/2 "2026-06-15T17:12:14Z")
I just tried regenerating the cert with a Preferred Chain flag of "R13" but I'm still getting a cert from YR2...not sure if that's an issue with the generation script not taking the flag properly or if there's some other reason it can't generate on that chain.... ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [June 15, 2026, 5:23pm UTC](https://community.letsencrypt.org/t/possible-chain-issue/248210/3 "2026-06-15T17:23:33Z")
> [@slightlycyberpunk](#): > > I'm using the fullchain file it generates in my nginx configuration. Double-check that. It sounds like you may be using only one or two of the certificates in that file, instead of all of them. > [@slightlycyberpunk](#): > > Preferred Chain flag of "R13" but I'm still getting a cert from YR2...not sure if that's an issue with the generation script not taking the flag properly or if there's some other reason it can't generate on that chain The preferred chain lets you pick a different path to a different root, but not a different intermediate. The intermediates change regularly, and so as long as you're using the full chain that the server presents it shouldn't matter what one you use. You'd only want a different preferred chain if you knew your clients could use a newer root like ISRG Root X2. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [June 15, 2026, 5:34pm UTC](https://community.letsencrypt.org/t/possible-chain-issue/248210/4 "2026-06-15T17:34:00Z")
> [@slightlycyberpunk](#): > > I have an ACME certificate plugin on my pfSense firewall that I use to renew my certs You should review this topic. There is a problem with pfSense dropping all but the first intermediate in the chain. > [@Pfsense invalid chains after Y generation cert](https://community.letsencrypt.org/t/pfsense-invalid-chains-after-y-generation-cert/247667/37): > > E… ---
**Author:** ![slightlycyberpunk](https://avatars.discourse-cdn.com/v4/letter/s/d07c76/32.png) [@slightlycyberpunk](https://community.letsencrypt.org/u/slightlycyberpunk)\ **Post date:** [June 15, 2026, 5:40pm UTC](https://community.letsencrypt.org/t/possible-chain-issue/248210/5 "2026-06-15T17:40:51Z")
Yep, that pfSense issue was it. THANK YOU, I've spent so many hours trying to sort this out and never suspected that plugin because I've been using it for years without encountering this issue...now to go update my scripts... ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 15, 2026, 5:41pm UTC](https://community.letsencrypt.org/t/possible-chain-issue/248210/6 "2026-07-15T17:41:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.